Sops: add support for kms key aliases

[snstanton]

It would be convenient be able to use a key alias as in:
aws kms encrypt --key-id alias/my-key ...
rather than having to provide the full arn.

[autrilla]

Duplicate of #366

[snstanton]

This isn't actually a duplicate of 366. I was talking about the AWS key alias mechanism (e.g. aws kms list-aliases) not just adding a string label in the .sops file. In some aws apis, you can specify either the ARN for the key or an alias like alias/mykey.

[autrilla]

Oh, cool, I didn't know that even existed! Reopening

[rosscdh]

This does not seem to be fixed in 3.3.0 as documented in changelog not in HEAD of master

func (key MasterKey) createSession() (*session.Session, error) {
    re := regexp.MustCompile(`^arn:aws[\w-]*:kms:(.+):[0-9]+:(key|alias)/.+$`)

requires the full arn (which defies the point of an alias?)

[autrilla]

I have no idea how that AWS feature works, but #415 shows you don't need to provide the full ARN. You need the account ID and the alias name. We still have to tell the AWS SDK that it's an alias somehow.

I'm not sure I understand why this is an issue for you. My guess (but it's just that, a guess) is that you're specifying the key through command line flags, which to me feels like doing it wrong. It is convenient for one-off operations and examples, but I don't think it really is how you should actually use sops. Using a .sops.yaml file is a better approach in my opinion.

[rosscdh]

Hey there thanks for the reply.

I'll check the sops yaml setup (am using it via the kustomize sops plugin FYI) but i suspect based on the code i pasted above the full arn will still be necessary

Also re the purpose of a kms alias: its point appears to be to not require the region nor acc id as per https://docs.aws.amazon.com/cli/latest/reference/kms/encrypt.html

--key-id (string)

A unique identifier for the customer master key (CMK).

To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias name, or alias ARN. When using an alias name, prefix it with "alias/" . To specify a CMK in a different AWS account, you must use the key ARN or alias ARN.

For example:

Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
Alias name: alias/ExampleAlias
Alias ARN: arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias

as you can see

aws kms encrypt \
    --key-id alias/ExampleAlias \
    --plaintext fileb://ExamplePlaintextFile \
    --output text \
    --query CiphertextBlob > C:\Temp\ExampleEncryptedFile.base64

is valid and then allows keys to be used independently of region and acc id

[autrilla]

I'll check the sops yaml setup (am using it via the kustomize sops plugin FYI) but i suspect based on the code i pasted above the full arn will still be necessary

I'm afraid so.

Also re the purpose of a kms alias: its point appears to be to not require the region nor acc id as per https://docs.aws.amazon.com/cli/latest/reference/kms/encrypt.html

--key-id (string)

A unique identifier for the customer master key (CMK).

To specify a CMK, use its key ID, Amazon Resource Name (ARN), alias name, or alias ARN. When using an alias name, prefix it with "alias/" . To specify a CMK in a different AWS account, you must use the key ARN or alias ARN.

For example:

Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab
Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
Alias name: alias/ExampleAlias
Alias ARN: arn:aws:kms:us-east-2:111122223333:alias/ExampleAlias

I see. I think it would indeed be nice to be able to provide the key in the same formats the AWS CLI takes, which we currently don't support.

[rosscdh]

@autrilla submitted a PR for review (needs tests but want to see if imp is ok first

https://github.com/mozilla/sops/pull/541