Metadata-Version: 1.1
Name: humilis-decrypt
Version: 0.0.2
Summary: Humilis plug-in to deploy a Lambda humilis_decrypt
Home-page: https://github.com/humilis/humilis-decrypt
Author: German Gomez-Herrero, FindHotel BV
Author-email: german@findhotel.net
License: MIT
Description: Custom CF resource to decrypt secrets in CF templates
        =====================================================
        
        |PyPI|
        
        A `humilis <https://github.com/humilis/blob/master/README.md>`__ plug-in
        layer that deploys a custom Cloudformation (CF) resource that can be
        used to decrypt secrets that are embedded in CF templates.
        
        **CREDIT:** All credit goes to `Casecommons
        lambda-cfn-kms <https://github.com/Casecommons/lambda-cfn-kms>`__. This
        repo is just the result of bundling the ``lambda-cfn-kms`` repository as
        a humilis plugin.
        
        Installation
        ------------
        
        ::
        
            pip install humilis-decrypt
        
        To install the development version:
        
        ::
        
            pip install git+https://github.com/humilis/humilis-decrypt
        
        Development
        -----------
        
        Assuming you have
        `virtualenv <https://virtualenv.readthedocs.org/en/latest/>`__
        installed:
        
        ::
        
            make develop
        
        Configure humilis:
        
        ::
        
            make configure
        
        How does it work?
        -----------------
        
        First create the Lambda function that backs the custom resource:
        
        ::
        
            make create
        
        The deployment will produce two artifacts:
        
        -  The ID of the KMS key associated with the custom resource.
        -  The ARN of the deployed Lambda function.
        
        You can use the KMS key ID to encrypt your secrets locally, e.g.
        assuming you want to encrypt the dummy DB password ``dummy`` with key
        ``3ea941bf-ee54-4941-8f77-f1dd417667cd``:
        
        ::
        
            aws kms encrypt --key-id 3ea941bf-ee54-4941-8f77-f1dd417667cd --plaintext 'dummy'
        
        The output will be something like this:
        
        ::
        
            {
                "CiphertextBlob": "AQICAHi2zdvZYfUQOQV8yX/HLdcIMqHHkubAYAei2Qo498KheQFDELPYHds8169cc9EqggEuAAAAZjBkBgkqhkiG9w0BBwagVzBVAgEAMFAGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQM+gDfP3DDVgbFYNidAgEQgCMrz1beR+s0XqWTVIuCbJ+E/cC7sqUzmPEB0weOhQ3GOE65rg==",
                "KeyId": "arn:aws:kms:eu-west-1:XXXXX:key/a86x4dd8-6b8e-41ce-aa65-4aa370d9ccbf"
            }
        
        Whenever you want to use your secret in a CF template you would do
        something like this:
        
        ::
        
            ---
            resources:
              DbPasswordDecrypt:
                Type: "Custom::KMSDecrypt"
                Properties:
                  ServiceToken: <lambda_function_arn>
                  Ciphertext: "AQICAHi2zdvZYfUQOQV8yX/HLdcIMqHHkubAYAei2Qo498KheQFDELPYHds8169cc9EqggEuAAAAZjBkBgkqhkiG9w0BBwagVzBVAgEAMFAGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQM+gDfP3DDVgbFYNidAgEQgCMrz1beR+s0XqWTVIuCbJ+E/cC7sqUzmPEB0weOhQ3GOE65rg=="
              DbInstance:
                Type: "AWS::RDS::DBInstance"
                Properties:
                  AllocatedStorage: "20"
                  DBInstanceClass: "db.m1.small"
                  Engine: "MySQL"
                  EngineVersion: "5.5"
                  MasterUsername: "admin"
                  MasterUserPassword:
                    Fn::Sub: ${DbPasswordDecrypt.Plaintext}
        
        where you will need to replace ``<lambda_function_arn>`` with the ARN of
        the Lambda function that backs the custom CF resource that implements
        the decryption logic.
        
        More information
        ----------------
        
        See `humilis <https://github.com/humilis/blob/master/README.md>`__
        documentation.
        
        Contact
        -------
        
        If you have questions, bug reports, suggestions, etc. please create an
        issue on the `GitHub project
        page <http://github.com/humilis/humilis-decrypt>`__.
        
        License
        -------
        
        See the original license in the
        `lambda-cfn-kms <https://github.com/Casecommons/lambda-cfn-kms#license>`__
        repository.
        
        .. |PyPI| image:: https://img.shields.io/pypi/v/humilis-decrypt.svg?style=flat
           :target: https://pypi.python.org/pypi/humilis-decrypt
        
Platform: UNKNOWN
Classifier: Programming Language :: Python :: 3
