AWS China is not supported in multiple AWS accounts use case
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 23.1k
- Forks
- 1.1k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 9
Description
In china, when I want to encrypt with --kms "KMS_ARN+ROLE_ARN" option as explain in https://github.com/mozilla/sops#assuming-roles-and-using-kms-in-various-aws-accounts, I obtain invalid ARN. I think the problem comes from the arn in china is different of other regions ("arn:aws-cn:iam::" instead of "arn:aws:iam::"). The arn is explicitly mentioned in the following line: https://github.com/mozilla/sops/blob/e1edc059487ddd14236dfe47267b05052f6c20b4/kms/keysource.go#L138
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in kms/keysource.go at the linked ARN handling line and inspect how IAM role ARNs are validated or parsed. Support the AWS China ARN partition shown in the report, then verify that the multiple-account KMS option accepts an arn:aws-cn:iam ARN without rejecting standard AWS ARNs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, go
- Domain
- cloud, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100