keystore 0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: ad74a93a05ef9aeb9ced232bea509de0eecb3eab
+  data.tar.gz: f9f142c30653d0f6dee86f8d8dc808a56402dcb5
+SHA512:
+  metadata.gz: 94ac6e846818166f9b083bc2dea775790246607ada08495381cf77d9083f17d1e04eeb0df2cfabcfaefd757e87978ae12da3d6c7b5b3a8d4558c5a8ed8056c3b
+  data.tar.gz: 54651c88bf02fbf88a04faed881d80f338b45c730e241ae59f47dc04033a0274cfaee4cf61ecff00147d056d69e02f8d48ee0cf4c922d2cd8245f870b18afcdc

data/bin/keystore.rb

@@ -0,0 +1,50 @@
+require 'keystore'
+require 'aws-sdk-core'
+require 'trollop'
+
+SUB_COMMANDS = %w(store retrieve)
+global_opts = Trollop.options do
+  opt :region, 'The region to look for the dynamodb in', default: 'us-east-1'
+  banner 'utility for storing and retrieving encrypted values
+  available commands:
+
+    store -- store a value in keystore
+    retrieve -- retrieve a value from keystore
+
+  use --help with either command for more information.
+  '
+  stop_on SUB_COMMANDS
+end
+
+cmd = ARGV.shift
+cmd_opts =
+  case cmd
+  when 'store'
+    Trollop.options do
+      opt :value, 'the value to be inserted into the keystore (required for store)', required: true, type: String
+      opt :kmsid, 'the kms key id to use to encrypt the data (required for store)', required: true, type: String
+      opt :keyname, 'the name of the key associated with the value', required: true, type: String
+      opt :table, 'the name of the table to perform the lookup on', required: true, type: String
+    end
+  when 'retrieve'
+    Trollop.options do
+      opt :keyname, 'the name of the key associated with the value', required: true, type: String
+      opt :table, 'the name of the table to perform the lookup on', required: true, type: String
+    end
+  else
+    Trollop.die "usage: keystore.rb [store|retrieve] [parameters]"
+  end
+
+dynamo = Aws::DynamoDB::Client.new region: global_opts[:region]
+kms = Aws::KMS::Client.new region: global_opts[:region]
+keystore = Keystore.new dynamo: dynamo, table_name: cmd_opts[:table], kms: kms, key_id: cmd_opts[:kmsid]
+
+case cmd
+when 'store'
+  keystore.store key: cmd_opts[:keyname], value: cmd_opts[:value]
+when 'retrieve'
+  result = keystore.retrieve key: cmd_opts[:keyname]
+  puts result
+else
+  fail "unknown subcommand #{cmd}"
+end

data/lib/keystore.rb

@@ -0,0 +1,32 @@
+require 'aws-sdk-core'
+require 'base64'
+
+# utility to use AWS services to handle encryption and storage of secret data.
+class Keystore
+  def initialize(params = {})
+    @options = params
+    fail 'need to specify dynamo parameter' if @options[:dynamo].nil?
+    fail 'need to specify table_name parameter' if @options[:table_name].nil?
+    fail 'need to specify kms parameter' if @options[:kms].nil?
+  end
+
+  def store(params)
+    # only need key id to encrypt, so check for it here
+    fail 'need to specify key_id parameter' if @options[:key_id].nil?
+    key_id = @options[:key_id]
+    encrypted_value = @options[:kms].encrypt(key_id: key_id, plaintext: params[:value]).ciphertext_blob
+    encoded_value = Base64.encode64(encrypted_value)
+    @options[:dynamo].put_item(
+      table_name: @options[:table_name],
+      item: { ParameterName: params[:key], Value: encoded_value }
+    )
+  end
+
+  def retrieve(params)
+    item = @options[:dynamo].get_item(table_name: @options[:table_name], key: { ParameterName: params[:key] }).item
+    fail "keyname #{params[:key]} not found" if item.nil?
+    encoded_value = item['Value']
+    encrypted_value = Base64.decode64(encoded_value)
+    @options[:kms].decrypt(ciphertext_blob: encrypted_value).plaintext
+  end
+end

metadata

@@ -0,0 +1,86 @@
+--- !ruby/object:Gem::Specification
+name: keystore
+version: !ruby/object:Gem::Version
+  version: '0.1'
+platform: ruby
+authors:
+- Jonny Sywulak
+- Stelligent
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2015-09-28 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: aws-sdk
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.1'
+- !ruby/object:Gem::Dependency
+  name: trollop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.1'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.1.2
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.1'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.1.2
+description: While building applications and continuous delivery pipelines, secret
+  management is usually one of the first non-trivial problems you run across. The
+  Keystore utility pairs to AWS services to handle encryption and storage of secret
+  data.
+email: jonny@stelligent.com
+executables:
+- keystore.rb
+extensions: []
+extra_rdoc_files: []
+files:
+- bin/keystore.rb
+- lib/keystore.rb
+homepage: http://www.stelligent.com
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+- lib
+- bin
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 2.2.2
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.4.8
+signing_key: 
+specification_version: 4
+summary: Secure storage of secrets using Amazon Web Services.
+test_files: []