Package: humilis-secrets-vault
Ahumilisplugin that implements asecrets-vaultlayer. The layer consists of
an encrypted DynamoDB table that serves secrets to Lambda functions in
the same humilis environment. The encryption and decryption of secrets
is handled by AWSKMS service.InstallationFromPyPI:pip install humilis-secrets-vaultTo install the dev version:pip install git+https://github.com/InnovativeTravel/humilis-secrets-vaultHow do I use this?Simply add this layer to yourhumilisenvironment and use the layer parameterassociated_processorsto
specify the layers that contain the Lambda functions that require access
to the secrets in the vault. For example, the environment below deploys
a Lambda function that processes events in a Kinesis stream. The Lambda
processor is granted access to the secrets vault that is also part of
the same environment:---
myenvironment:
    description:
        An environment with a Lambda processor to filter events in a Kinesis
        stream.

    layers:
        - layer: streams
          layer_type: streams
          streams:
              - name: InputStream
                shard_count: 1

        - layer: event-processor
          layer_type: kinesis-processor
          dependencies: ["streams"]
          input: {layer: streams, stream: InputStream}

        - layer: secrets-vault
          layer_type: secrets-vault
          # We specify that the Lambda function in the event-processor layer
          # should have access to the secrets in the vault.
          associated_processors: ["event-processor"]Thesecrets-vaultlayer expects that the layer(s) that contain the
Lambda processor(s) expose a layer outputLambdaFunctionArnwith the
ARN of the Lambda function that should have access to the secrets in the
vault. Layers of typekinesis-processoras in the example above fulfil this expectation so they will work
out-of-the-box.Retrieving secretsThe easiest way of retrieving secrets from your Lambda function is to
include packagelambdautilsas a
depencency.Then you can easily retrieve secrets from the vault within your Lambda
code as follows:import lambdautils.utils as utils

# Assuming that you are deploying this Lambda with humilis the line below
# will indicate humilis to preprocess this function with Jinja2 before
# producing the Lambda deployment package.
# preprocessor:jinja2

# During deployment, humilis will replace here the name of the humilis
# environment and deployment stage.
ENVIRONMENT = "{{_env.name}}"
STAGE = "{{_env.stage}}"

plaintext = utils.get_secret(
    "my_secret_key", environment=ENVIRONMENT, stage=STAGE)Storing secretsYou can usehumilisto store secrets in the vault from the command line:humilis set-secret --stage [STAGE] [ENVIRONMENT_FILE] [SECRET_KEY] [SECRET_VALUE]DevelopmentAssuming you havevirtualenvinstalled:make developConfigure humilis:.env/bin/humilis configure --localTestingYou can test the deployment of the secrets vault using:makecreateThen you can then run the integration test suite (TBD):make testiDon’t forget to delete the test deployment once you are done:makedeleteMore informationSeehumilisdocumentation.ContactIf you have questions, bug reports, suggestions, etc. please create an
issue on theGitHub project
page.LicenseThis software is licensed under theMIT
license.SeeLicense
file.© 2016 German Gomez-Herrero,Find
Hoteland others.