AWS Profile flag doesn't work
Open
Nobody has claimed this yet.
area/keyservice
bug
help wanted
keyservice/awskms
- Dominant language
- Go
- Stars
- 23.1k
- Forks
- 1.1k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 9
Description
Sops 3.2.0 on OS X installed with Brew.
sops -d test-env.secret.sops.yml --aws-profile production
Failed to get the data key required to decrypt the SOPS file.
Group 0: FAILED
arn:aws:kms:us-east-1:426575684472:key/b09749f5-2a39-4ac6-af5e-da9ca8c06194: FAILED
- | Error decrypting key: AccessDeniedException: The ciphertext
| refers to a customer master key that does not exist, does
| not exist in this region, or you are not allowed to access.
| status code: 400, request id:
| cdf0ce06-d30e-7451-84d8-584d4052b716
Recovery failed because no master key was able to decrypt the file. In
order for SOPS to recover the file, at least one key has to be successful,
but none were.
However, export AWS_PROFILE=production works just fine.
ID's and uuids filtered.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the CLI entry point that handles --aws-profile and compare its credential selection with the AWS_PROFILE environment-variable path. Reproduce the reported sops -d command against an AWS KMS-encrypted file, then verify that the flag selects the same profile and allows decryption.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, go
- Domain
- cli, cloud, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100