Sops: Cannot KMS decrypt files using aws assume-role feature

[jessechahal]

the aws-sdk-go library had a bug regarding reading local credentials files that essentially caused assume-role not to work. This feature is commonly used by companies that use multiple aws accounts for organization of infrastructure as well as security reasons. It appears that the latest release of sops (as well as some old releases) contain this bug. Would it be possible to update the aws-sdk-go library to either use v0.7.3 or newer v0.9.X versions of this library? It seems like sops is already using the newest aws-sdk-go library. This is an odd issue...
https://github.com/aws/aws-sdk-go/issues/348

$sops secrets.json
Could not decrypt the data key with any of the master keys:
    [KMS]: arn:aws:kms:us-east-1:0000000:key/XXXX-XXXX-XXXX-XXXX:   Error decrypting key: NoCredentialProviders: no valid providers in chain. Deprecated.
    For verbose messaging see aws.Config.CredentialsChainVerboseErrors

Is the error I'm seeing with the latest sops release

[jessechahal]

Does SOPS make any assumptions on which AWS credentials need to be used? My current workflow is setting the AWS_PROFILE to be a profile which assumes a role using the instructions from http://docs.aws.amazon.com/cli/latest/userguide/cli-roles.html . From what I could tell SOPS seems to be respecting this. These instructions work for our own internally developed, boto3 based, libraries without any code modifications. We've tested this using SOPS 2.0.9 and 3.0.0 and had the same issue both times.

[jessechahal]

More research seems to indicated that we need to use stsCreds.AssumeRoleProvider as part of the provider chain.

[autrilla]

SOPS only tries to assume roles if a role is specified on the key ARN when the file is first encrypted. If none is specified, SOPS just creates a new session using the createSession method: https://github.com/mozilla/sops/blob/master/kms/keysource.go#L182-L201.

SOPS just relies on the AWS SDK to figure out which credentials need to be used. I would expect the AWS SDK to honor this, but maybe they don't?

[jessechahal]

hmm I guess I could decrypt and reencrypt every single encrypted file while assuming a role (rather not). Although that would mean that this bug still exists within sops and others will probably encounter it as cross-account roles become more common (rather than separating environments by region).

Its odd that the aws go SDK would be the only one that didn't respect this. I'm only familiar with the boto python SDK. It seems like if that was the case it would be a bug in the SDK. My current assumption is that the go SDK only respects this for common cases but ignores it for certain cases (whether on purpose or by design) and that is what we are hitting.

[jessechahal]

So I think I figured out a solution to this issue. following https://github.com/aws/aws-sdk-go/issues/934 you just need to set the environment variable AWS_SDK_LOAD_CONFIG=1. I think the aws sdk's for other languages this is enabled on default but for the aws-go-sdk this flag is not?

[jessechahal]

I'll reopen this issue if this solution is found not to work in certain cases