Metadata-Version: 2.1
Name: secretcli
Version: 0.1.3
Summary: UNKNOWN
Home-page: https://github.com/tedivm/secretcli
Author: Robert Hafner
Author-email: tedivm@tedivm.com
License: UNKNOWN
Download-URL: https://github.com/tedivm/secretcli/archive/v0.1.3.tar.gz
Platform: UNKNOWN
Classifier: Development Status :: 4 - Beta
Classifier: License :: OSI Approved :: MIT License
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: System Administrators
Classifier: Programming Language :: Python :: 3
Classifier: Environment :: Console
Requires-Python: >=3
Requires-Dist: boto3 (<2.0,>=1.9)
Requires-Dist: click (<8.0,>=6.0)
Requires-Dist: requests
Requires-Dist: pyyaml
Requires-Dist: urllib3 (<1.24)
Provides-Extra: dev
Requires-Dist: pypandoc; extra == 'dev'
Requires-Dist: twine; extra == 'dev'
Requires-Dist: wheel; extra == 'dev'

secretcli
=========

The secretcli project provides a simple to use command line interface to
the `AWS Secrets Manager <https://aws.amazon.com/secrets-manager/>`__.
It is capable of uploading or downloading the entire secret as well as
working with individual fields.

Installing
----------

This project is available on
`pypi <https://pypi.org/project/secretcli/>`__ and can be installed with
pip.

``pip3 install secretcli``

Usage
-----

Initializing a new Secret
~~~~~~~~~~~~~~~~~~~~~~~~~

New secrets are easy to initiate. This will create a new Secret in the
AWS Secret Manager and store an empty javascript object as the first
version.

.. code:: bash

   $ secretcli init TestSecret

Working with individual Keys
~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Additional Key/Value pairs can be added to the secret using a single
command. Behind the scenes this downloads the existing database, updates
it with the new key/value pair, and uploads it as the current version.

.. code:: bash

   $ secretcli set TestSecret postgreshost 10.10.10.16
   $ secretcli set TestSecret postgresuser postgres
   $ secretcli set TestSecret postgrespassword super_secret_string
   $ secretcli set TestSecret longstring "This is a string with spaces."

Retrieving values is just as simple. This can be useful when trying to
use values in bash scripts.

.. code:: bash

   $ secretcli get TestSecret postgreshost
   10.10.10.16
   $ secretcli get TestSecret postgresuser
   postgres
   $ secretcli get TestSecret postgrespassword
   super_secret_string

Values can also be completely removed from the secret.

.. code:: bash

   $ secretcli get TestSecret postgreshost
   10.10.10.16
   $ secretcli remove TestSecret postgreshost
   $ secretcli get TestSecret postgreshost

To avoid passing the value directly into the console (potentially
logging it in places like bash history) the ``-s`` flag can be passed
and the value can be passed in interactively without displaying it.

.. code:: bash

   $ secretcli set TestSecret postgrespassword -s
   Value:
   Repeat for confirmation:
   $ secretcli get TestSecret postgrespassword
   super_secret_string

Working with entire Files
~~~~~~~~~~~~~~~~~~~~~~~~~

The entire Secret can be downloaded as a file. This command works
regardless of the format of the file- Secrets that are not managed by
``secretcli`` can be downloaded using this tool.

.. code:: bash

   $ secretcli download TestSecret ./secret_configuration.json

The file can also be uploaded- but be careful, it will be uploaded
exactly as is without any verification of the json formatting.

.. code:: bash

   $ secretcli upload TestSecret ./secret_configuration.json

Datastore Format
----------------

``secretcli`` stores data as a JSON Object in an attempt to be as
interoperable as possible. Each ``key`` passed to ``secretcli`` is
represented by a ``key`` in the JSON Object.

When storing in AWS Secret Manager ``secretcli`` uses the
``SecretString`` field in the AWS Secrets Manager. This allows the
database to be viewed in the AWS Console both as a raw string and using
the Key/Value table.


