Package: s3keyring
S3 backend for Python’s keyringThis module adds anAWS S3backend to Python’skeyringmodule. The S3
backend will store the keyring credentials in an S3 bucket and use client and
server side encryption to keep the credentials safe both during transit and at
rest. This backend is quite handy when you want to distribute credentials across
multiple machines. Access to the backend and to the encryption keys can be
finely tuned using AWS IAM policies.InstallationYou can install a stable release from Pypi:pip install s3keyringOr you can choose to install the development version:pip install git+https://github.com/InnovativeTravel/s3-keyringIn Mac OS X El Capitan and later you may run into permission issues
when runningpip install. A workaround is to installs3keyringusing:sudo -H pip install --ignore-installed git+https://github.com/InnovativeTravel/s3-keyringA better solution is to install Python with homebrew so thatpip installwill
not attempt to install packages in any system directory:brew install pythonFor Admins: setting up the keyringIf you are just a user of the keyring and someone else has set up the keyring
for you then you can skip this section and go directly toFor Keyring Users: accessing the keyringat the end of this README. Note that you will need
administrator privileges in your AWS account to be able to set up a new keyring
as described below.S3 bucketThe S3 keyring backend requires you to have read/write access to a S3 bucket.
If you want to use bucketmysecretbucketto store your keyring, you will
need to attach the followingIAM policyto all the IAM user accounts or
roles that will have read and write access to the keyring:{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": "arn:aws:s3:::mysecretbucket",
            "Condition": {}
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:DeleteObject",
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::mysecretbucket/*"
        }
    ]
}If you want to create a policy that grants read-only access to the keyring then
remove thes3:PutObjectands3:DeleteObjectactions from the policy
above.Encryption keyYou need to create aKMS encryption key. Write down the ID of the
KMS key that you create. You will need to share this KMS Key ID with the
users of the keyring.IMPORTANT: You will need to grant read access to the KMS key to every IAM
user or role that needs to access the keyring.For users: accessing the keyringOne-time configurationIf you haven’t done so already, you will need to configure your local
installation of theAWS CLIby running:aws configureThen configure the S3 Keyring:s3keyring configureYour keyring administrator will provide you with theKMS Key ID,BucketandNamespaceconfiguration options. OptionAWS profileallows you to specify the localAWS CLI profileyou want to use to sign all
requests sent to AWS when accessing the keyring. Most users will want to use
thedefaultprofile.IMPORTANT: when deploying thes3keyringin EC2 instances that are granted
access to the keyring by means of anIAM roleyou should not specify a
custom AWS profile when configuring s3keyring in the instances.You can configure thes3keyringmodule without user input by setting the
following environment variables:S3KEYRING_BUCKET,S3KEYRING_NAMESPACE,S3KEYRING_KMS_KEY_ID,S3KEYRING_AWS_PROFILE. If these environment variables
are properly set then you can configure thes3keyringmodule with:s3keyring configure --no-askConfiguration profilesYou can uses3keyringto store (read) secrets in (from) more than one
backend S3 keyring. A typical use case is creating different keyrings for
different user groups that have different levels of trust. For instance your
keyring administrator may have setup a S3 keyring that only IAM users with admin
privileges can access. Using the bucket, KMS Key ID and namespace provided by
your keyring admin you can configure a separates3keyringprofile to access
that admins-only keyring:s3keyring --profile administrators configureYour keyring admin may have also setup a separate S3 keyring to store secrets
that need to be accessed by EC2 instances that act as backend workers in a
project you are part of. To access that keyring you would configure a
seconds3keyringprofile:s3keyring --profile website-workers configureThen, to store and retrieve secrets in the administrators keyring:s3keyring --profile administrators set SERVICE ACCOUNT PASSWORD
s3keyring --profile administrators get SERVICE ACCOUNTAnd you could do the same for thewebsite-workerskeyring using option--profilewebsite-workers.Configuration fileBy defaults3keyringreads configuration options from~/.s3keyring.ini.
You can also store the configuration in a.s3keyring.inifile stored in your
current working directory by using:s3keyring configure --locals3keyringwill always read the configuration first from a.s3keyring.inifile under your current work directory. If it is not found then it will read it
from~/.s3keyring.ini.UsageThes3keyringmodule provides the same API as Python’skeyring module.
You can access your S3 keyring programmatically from your Python code like
this:from s3keyring.s3 import S3Keyring
kr = S3Keyring()
kr.set_password('groupname', 'username', '123456')
assert '123456' == kr.get_password('groupname', 'username')
kr.delete_password('groupname', 'username')
assert kr.get_password('groupname', 'username') is NoneYou can also use the keyring from the command line:# Store a password
s3keyring set groupname username 123456
# Retrieve it
s3keyring get groupname username
# Delete it
s3keyring delete groupname usernameRecommended workflowThis is how I uses3keyringin my Python projects.Let’s assume that my project root directory looks something like this:setup.py
my_module/
          __init__.pyIn my project root directory I run:s3keyring configure --localI keep the generated.s3keyring.inifile as part of my project source code
(i.e. under version control). Then in my project code I use the keyring like
this:from s3keyring.s3 import S3Keyring

keyring = S3Keyring(config_file="/path/to/s3keyring.ini")
keyring.set_password('service', 'username', '123456')
assert keyring.get_password('service', 'username') == '123456'ContactIf you have questions, bug reports, suggestions, etc. please create an issue on
theGitHub project page.LicenseThis software is licensed under theMIT licenseSeeLicense file© 2020 German Gomez-Herrero, andFindHotel.AuthorsGerman Gomez-Herrerooriginal idea and implementationThese people have contributed tos3keyring, in alphabetical order:Ilya KalininChangelog0.2.2Fix pycparser version to prevent bug in pycparser 2.150.2.2Change naming conventions: secret namespaces, groups and keys0.2.0Don’t use the local keychain if the s3keyring config file says so0.1.0Doc fixesNew keyring method to list secrets associated to a service0.0.12Docs fixesFixes in the handling of project-specific configs0.0.2Minor fixes in docs and package data0.0.1Initial release (germangh)