Store AWS KMS Key Id instead of Alias in encrypted files
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 23.1k
- Forks
- 1.1k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 9
Description
Support for AWS KMS Aliases was requested in mozilla/sops#381 and implemented in mozilla/sops#415. We tried to switch to aliases in the creation_rules, but noticed that the alias' ARN is being stored in encrypted files instead of the key's ARN.
If an alias is deleted or reassigned to another key, it's impossible to find out which KMS Key was actually used.
The EncryptOutput returned by KMS.Encrypt contains the Key Id¹ that was used during encryption and that is what should be stored in the encrypted file.
¹ I'm not sure if this is just the Id or the ARN. See https://docs.aws.amazon.com/kms/latest/APIReference/API_Encrypt.html#API_Encrypt_ResponseSyntax (including the examples)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Trace the Go code that calls KMS.Encrypt while processing creation_rules, then follow how its EncryptOutput is recorded in encrypted files. Check the AWS Encrypt response documentation to resolve whether the returned KeyId is an ID or ARN; done means the file preserves the identifier for the key actually used rather than the alias ARN.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, go
- Domain
- cloud, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100