kms-env 1.0.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 415d11659a3e85d11bf8d6eed6cb5b3764556598
+  data.tar.gz: dcbd97720cd59b41a25856a0057db0b95f79c17a
+SHA512:
+  metadata.gz: d9b91d74a84775de8a0ef8cd72928bceb41b2071d39781c4bae8376ebb6a1cd29434b60be9d9774a4bdf3e23e6c3aaee4c36e7617df7f64d236a23b1b98f522a
+  data.tar.gz: a3261b3939cd7cc548e4f551fa652a61f924d49917cb6fa1cd3d658cd1168985baf2768daf11820d74cd51363dbe3d0fd61cf92e2ff80abc9bcee917f7d9cce9

data/lib/kms-env/railtie.rb

@@ -0,0 +1,13 @@
+module KmsEnv
+  class Railtie < Rails::Railtie
+    config.before_configuration { load }
+
+    def load
+      KmsEnv.load
+    end
+
+    def self.load
+      instance.load
+    end
+  end
+end

data/lib/kms-env.rb

@@ -0,0 +1,55 @@
+require 'base64'
+require 'aws-sdk'
+
+module KmsEnv
+
+  module_function
+
+  def logger
+    defined?(Rails) ? Rails.logger : Logger.new(STDERR)
+  end
+
+  ###
+  # Load decrypted environment variables
+  ###
+
+  def kms
+    @kms ||= Aws::KMS::Client.new(region: ENV['AWS_REGION'] || 'us-east-1')
+  end
+
+  def ciphertext_blob_for(text)
+    Base64.decode64(text)
+  end
+
+  def kms_decrypt_blob(blob)
+    kms.decrypt(ciphertext_blob: blob)
+  rescue Exception => e
+    self.logger.error("Failed to decrypt #{key} with error #{e.class}")
+    if defined?(Honeybadger)
+      Honeybadger.notify(e)
+    end
+  end
+
+  def plaintext_key_for(key)
+    key.gsub(kms_key_matcher, '')
+  end
+
+  def set_decrypted_env_for(key)
+    # skip values that have already been decrypted
+    return if ENV[plaintext_key_for(key)]
+    ENV[plaintext_key_for(key)] = kms_decrypt_blob(ciphertext_blob_for(ENV[key])).first.plaintext
+  end
+
+  def kms_key_matcher
+    /_KMS$/
+  end
+
+  def load
+    ENV.keys.select {|k| k =~ kms_key_matcher}.each do |key|
+      set_decrypted_env_for(key)
+    end
+  end
+
+end
+
+require 'kms-env/railtie' if defined?(Rails)

metadata

@@ -0,0 +1,101 @@
+--- !ruby/object:Gem::Specification
+name: kms-env
+version: !ruby/object:Gem::Version
+  version: 1.0.0
+platform: ruby
+authors:
+- Drew Stokes
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2015-04-30 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: aws-sdk
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '10.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '10.0'
+description: Decrypt environment variables encrypted with Amazon's KMS service
+email: drew.stokes@fullscreen.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- lib/kms-env.rb
+- lib/kms-env/railtie.rb
+homepage: https://github.com/fullsceen/kms-env
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.2.2
+signing_key: 
+specification_version: 4
+summary: Environment decryption with KMS
+test_files: []