5
2

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

More than 5 years have passed since last update.

yaml_vaultで階層化された特定のkeyのみを暗号化・復号化する方法

Last updated at Posted at 2016-10-07

yaml_vaultについて

AWS Key Management Serviceを使ってconfigファイルを暗号化すると便利 - Qiita を参照

やりたかったこと

下記のようなyamlがあった時に、access_key_idsecret のみを暗号化・復号化し、それ以外のkeyはそのまま保存したかった。

accounts.yml
accounts:
  ACCOUNT_1:
    access_key_id: XXXXXXX
    secret: XXXXXXXX
    regions:
      - ap-northeast-1

  ACCOUNT_2:
    access_key_id: XXXXXXX
    secret: XXXXXXXX
    regions:
      - ap-northeast-1

--key=accounts で渡すと access_key_idsecret だけでなく regions も暗号化されてしまうので困りもの。

このissueに近かったのでPR投げようかと思ったのですが、コードを読むと思った以上に面倒くさそうだったので別のやり方で解決しました。

Wildcards in --key · Issue #4 · joker1007/yaml_vault

解決策

yaml_vaultは暗号化対象のkeyをカンマ区切りで複数渡せるので下記のようにrake taskで必要なkeyを生成してからyaml_vaultに渡すようにしました。

lib/tasks/vault.rake
namespace :vault do
  require "yaml"

  region = "ap-northeast-1"

  def vault_keys(yaml_file)
    config = YAML.load_file(yaml_file)
    account_keys = config["accounts"].keys
    account_keys.each_with_object([]) do |key, array|
      array << "accounts.#{key}.access_key_id"
      array << "accounts.#{key}.secret"
    end.join(",")
  end

  desc "encrypt accounts.yml and generate encrypted_accounts.yml (params: SRC_FILE, DST_FILE)"
  task :encrypt do
    kms_key_id = "XXXXXXXXXXXXXX"
    src_file = ENV["SRC_FILE"] || "config/accounts.yml"
    dst_file = ENV["DST_FILE"] || "config/encrypted_accounts.yml"
    keys = vault_keys(src_file)
    sh "AWS_REGION=#{region} yaml_vault encrypt #{src_file} -o #{dst_file} --cryptor=aws-kms -k #{keys} --aws-kms-key-id=#{kms_key_id}"
  end

  desc "decrypt encrypted_accounts.yml and generate accounts.yml (params: SRC_FILE, DST_FILE)"
  task :decrypt do
    src_file = ENV["SRC_FILE"] || "config/encrypted_accounts.yml"
    dst_file = ENV["DST_FILE"] || "config/accounts.yml"
    keys = vault_keys(src_file)
    sh "AWS_REGION=#{region} yaml_vault decrypt #{src_file} -o #{dst_file} --cryptor=aws-kms -k #{keys}"
  end
end

AWS_REGION を環境変数で渡しているのはIAMロールを使いたかったためです 1

実行結果

$ bundle exec rake vault:encrypt
AWS_REGION=ap-northeast-1 yaml_vault encrypt config/accounts.yml -o config/encrypted_accounts.yml --cryptor=aws-kms -k accounts.ACCOUNT_1.akid,accounts.ACCOUNT_1.secret,accounts.ACCOUNT_2.akid,accounts.ACCOUNT_2.secret --aws-kms-key-id=XXXXXXXXXXXXXX
encrypted config/accounts.yml -> config/encrypted_accounts.yml

よさげ

  1. 詳しく実装を追ってないですが --aws-region を渡すと --aws-access-key-id--aws-secret-access-key も必要になってIAMロールを使ってくれない模様

5
2
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
5
2

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?