Deprecate storing aws profile within the encrypted file / with the key
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 23.1k
- Forks
- 1.1k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 9
Description
There seems to have been a number of issues surrounding our use of AWS profiles:
- https://github.com/mozilla/sops/issues/471
- https://github.com/mozilla/sops/issues/614
- https://github.com/mozilla/sops/issues/619
- https://github.com/mozilla/sops/issues/474
- https://github.com/mozilla/sops/issues/439
Storing the AWS Profile in the encrypted file breaks expectations because it cannot be decrypted on systems where that profile doesn't exist. This is very different from how folks are used to interacting with AWS.
I'd propose that we deprecate storing the aws profile within the key and instead require users to pass --aws-profile every time they want to use an AWS profile.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the linked issues and the current handling of AWS profiles, then trace how --aws-profile is used when reading encrypted files. Determine the deprecation and migration behavior before changing the command interface. Done means the proposed profile handling is specified and covered across the affected AWS workflows.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, go
- Domain
- cli, cloud, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100