Sops: QUESTION: encrypted-regex as param in .sops.yaml

[HerrmannHinz]

hi.

as the tittle says i wanna approach something like:

.sops.yaml
content:
```creation_rules:

• encrypted-regex: 'example_number|example_array'
  kms: "arn:aws:kms:eu-central-1:xxxx:key/xxxx"
  ```

is this possible or do i need to give the regex always via the command line arg?

[HerrmannHinz]

hi.

as the tittle says i wanna approach something like:

.sops.yaml
content:

- encrypted-regex: 'example_number|example_array'
  kms: "arn:aws:kms:eu-central-1:xxxx:key/xxxx"

is this possible or do i need to give the regex always via the command line arg?

found this in the readme:

```A third method is to use the --encrypted-regex which will only encrypt values under keys that match the supplied regular expression. For example, this command:

$ sops --encrypt --encrypted-regex '^(data|stringData)$' k8s-secrets.yaml
will encrypt the values under the data and stringData keys in a YAML file containing kubernetes secrets. It will not encrypt other values that help you to navigate the file, like metadata which contains the secrets' names.

You can also specify these options in the .sops.yaml config file.

Note: these three options --unencrypted-suffix, --encrypted-suffix, and --encrypted-regex are mutually exclusive and cannot all be used in the same file.
```
but when trying to set them like in my above provided stanza it still encrypts ALL values.

[ancoron]

Hi, the following works on my side (Linux, SOPS 3.6.0):

creation_rules:
  - path_regex: .*\.dev\.json$
    encrypted_regex: '^(user.*|pass.*|.*[Bb]earer.*|.*[Kk]ey|.*[Kk]eys|salt|sentry.*|.*[Tt]oken)$'
    kms: ...

_(please note the underscore instead of the dash)_

...which encrypts only the fields I expect to be encrypted, e.g.:

{
  "master": {
    "user": "ENC[AES256_GCM,data:OBIS,iv:mCLhGEGZ0wWgHlml/+xsFweDdpZ6P8baN5RZMU7BWh8=,tag:ycxsSQlZO3WH4r7gZa16TQ==,type:str]",
    "password": "ENC[AES256_GCM,data:vXjP,iv:o42e2poGR52DWfNIQkFJu67sT7GETC5k7xUjSCBlpt0=,tag:ygLz5PenJCqrn+Kn/rpxnQ==,type:str]",
    "host": "mysql-accounts",
    "port": 3306,
    "connectionLimit": 10,
    "waitForConnections": true,
    "queueLimit": 100
  }
}

[HerrmannHinz]

@ancoron thanks will try! maybe i was missing the path_regex part.

[autrilla]

It's probably because it's called encrypted_regex and not encrypted-regex.

Anyway, glad you found a solution.

[HerrmannHinz]

It's probably because it's called encrypted_regex and not encrypted-regex.

Anyway, glad you found a solution.

you are right. underscore vs dash. thanks man!