aws-kms-thingy
Convenience wrapper around the AWS Node.js SDK to simplify encrypting/decrypting secrets with the AWS KMS service. Suitable for use with AWS Lambda.
Contents
Features
- Unencrypted strings simply returned, useful for testing/local development
- Encrypt/decrypt multiple values in one go
- Results are cached, so multiple decrypt/encrypt calls incur only a single call to the AWS SDK
- CLI to encrypt/decrypt secrets
- Well tested
Usage
The module assumes that the Amazon SDK has access to AWS credentials that are able to access the KMS key used for encryption and decryption.
npm install aws-kms-thingy aws-sdk@^2
With the CLI
Encrypt with:
aws-kms-thingy encrypt
You'll be prompted for the string to encrypt.
Decrypt with:
aws-kms-thingy decrypt
You'll be prompted for the encrypted string to decrypt.
With AWS Lambda
Safe to use within a Lambda handler. After cold-start, decrypted values are cached so subsequent invocations won't incur an AWS KMS API call:
const decrypt = moduleexports { // Only incurs network call on cold-start }
With Multiple Secrets
Decrypt multiple values in parallel
Locally In Development
Providing a non-base64 encoded value will skip en/decrypting with AWS KMS and just return the same value. This is useful in local development where you may not be necessary to have your secrets encrypted. This helps to avoid the need to write development environment exception code:
process.env.DATABASE_PASSWORD = 'foobar' console.logdbPassword // "foobar"
An undefined
value is also OK. This does nothing and returns undefined. Useful when environment variables are unset in local development.
process.env.DATABASE_PASSWORD = undefined // e.g. not set in development console.logdbPassword // undefined
Alternatively, one can also disable en/decryption entirely with DISABLE_AWS_KMS_THINGY
environment variable:
process.env.DISABLE_AWS_KMS_THINGY = 'true' console.logtoken // "aHR0cDovL2JpdC5seS8xVHFjd243"
API
Methods
encrypt(parameters)
Encrypt a plaintext string. Requires a AWS KMS key ID (or key Arn).
const ciphertext = await
decrypt(ciphertext)
AWS KMS encrypted ciphertext contains metadata so it is not necessary to provide context or key ID.
Decrypt KMS-encrypted ciphertext.
const plaintext = await
Related Thingies
- aws-s3-thingy
- alagarr — AWS Lambda/API Gateway Request/Response Thingy
- aws-kms-crypt
License
aws-kms-thingy © Marco Lüthy. Released under the MIT license.
Authored and maintained by Marco Lüthy with help from contributors.
github.com/adieuadieu · GitHub @adieuadieu · Twitter @adieuadieu · Medium @marco.luethy