humilis-secrets-vault 0.0.2

Installation

From [PyPI][pypi]:

pip install humilis-secrets-vault

To install the dev version:

pip install git+https://github.com/InnovativeTravel/humilis-secrets-vault

How do I use this?

Simply add this layer to your humilis environment and use the layer parameter associated_processors to specify the layers that contain the Lambda functions that require access to the secrets in the vault. For example, the environment below deploys a Lambda function that filters events in a Kinesis stream and gives the Lambda access to the secrets vault that is also part of the same environment:

---
myenvironment:
    description:
        An environment with a Lambda processor to filter events in a Kinesis
        stream.

    layers:
        - layer: streams
          layer_type: streams
          streams:
              - name: InputStream
                shard_count: 1
              - name: OutputStream
                shard_count: 1
              - name: MatchedStream
                shard_count: 1

        - layer: filter
          layer_type: filter
          dependencies: ["streams"]
          input: {layer: streams, stream: InputStream}
          output: {layer: streams, stream: OutputStream}
          # Do not delivered the unmatched events anywhere
          matched: {layer: streams, stream: MatchedStream}
          input_delivery: False
          output_delivery: False
          matched_delivery: False

        - layer: secrets-vault
          layer_type: secrets-vault
          # We specify that the Lambda processor in the filter layer should
          # have access to the secrets in the vault.
          associated_processors: ["filter"]

import lambdautils.utils as utils

plaintext = utils.get_secret("key_for_my_secret")

humilis set-secret --stage [STAGE] [ENVIRONMENT_FILE] [SECRET_ID] [SECRET_VALUE]

Deployment requirements

You need to install humilis and configure a local profile:

humilis configure --local

The command above will create a .humilis.ini file that you can keep with the rest of your code. This repository contains one such file with values that make sense for people working at Innovative Travel.

Development

Assuming you have virtualenv installed:

make develop

Configure humilis:

.env/bin/humilis configure --local

Testing

You can test the deployment of the secrets vault using:

make create

Then you can then run the integration test suite (TBD):

make testi

Don’t forget to delete the test deployment once you are done:

make delete

More information

See humilis documentation.

Who do I ask?

Ask German.