lambdavault 0.1.0__tar.gz

lambdavault-0.1.0/PKG-INFO

@@ -0,0 +1,41 @@
+Metadata-Version: 2.4
+Name: lambdavault
+Version: 0.1.0
+Summary: HashiCorp Vault on AWS Lambda + S3 + KMS, ≈ $0 when idle. The vault CLI, hvac and the Terraform vault provider talk to it unchanged; this package is the helper: status, output.
+Author: Frank Zhang
+License: MIT
+Project-URL: Homepage, https://github.com/cloudformer/lambdavault
+Project-URL: Repository, https://github.com/cloudformer/lambdavault
+Project-URL: Deploy, https://github.com/cloudformer/lambdavault#quick-start
+Project-URL: Compatibility, https://github.com/cloudformer/lambdavault/blob/main/tests/compat/REPORT.md
+Project-URL: Changelog, https://github.com/cloudformer/lambdavault/blob/main/CHANGELOG.md
+Project-URL: Issues, https://github.com/cloudformer/lambdavault/issues
+Keywords: serverless,aws,lambda,vault,hashicorp-vault,secrets,kms
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+
+# lambdavault
+
+**HashiCorp Vault, truly serverless: the official Vault binary on AWS Lambda, data in S3, auto-unseal by KMS,
+≈ $1 a month when idle.** Part of [Redefine AWS Serverless](https://github.com/topics/redefine-aws-serverless).
+
+![lambdavault architecture](https://raw.githubusercontent.com/cloudformer/lambdavault/main/docs/architecture.svg)
+
+The vault CLI, hvac and the Terraform vault provider are the clients — unchanged, only `VAULT_ADDR` points at
+the Lambda. This package is the helper around a deployment:
+
+```bash
+pip install lambdavault
+lambdavault status    # initialized / sealed / version / latency (address from terraform output)
+eval "$(lambdavault output)"   # export VAULT_ADDR for the vault CLI
+vault operator init -recovery-shares=1 -recovery-threshold=1   # once
+vault kv get kvv2/app
+```
+
+Deploy the server from the [main repository](https://github.com/cloudformer/lambdavault) with Terraform.
+Compatibility with a normal Vault: [REPORT.md](https://github.com/cloudformer/lambdavault/blob/main/tests/compat/REPORT.md).

lambdavault-0.1.0/README.md

@@ -0,0 +1,20 @@
+# lambdavault
+
+**HashiCorp Vault, truly serverless: the official Vault binary on AWS Lambda, data in S3, auto-unseal by KMS,
+≈ $1 a month when idle.** Part of [Redefine AWS Serverless](https://github.com/topics/redefine-aws-serverless).
+
+![lambdavault architecture](https://raw.githubusercontent.com/cloudformer/lambdavault/main/docs/architecture.svg)
+
+The vault CLI, hvac and the Terraform vault provider are the clients — unchanged, only `VAULT_ADDR` points at
+the Lambda. This package is the helper around a deployment:
+
+```bash
+pip install lambdavault
+lambdavault status    # initialized / sealed / version / latency (address from terraform output)
+eval "$(lambdavault output)"   # export VAULT_ADDR for the vault CLI
+vault operator init -recovery-shares=1 -recovery-threshold=1   # once
+vault kv get kvv2/app
+```
+
+Deploy the server from the [main repository](https://github.com/cloudformer/lambdavault) with Terraform.
+Compatibility with a normal Vault: [REPORT.md](https://github.com/cloudformer/lambdavault/blob/main/tests/compat/REPORT.md).

lambdavault-0.1.0/lambdavault/__init__.py

@@ -0,0 +1,4 @@
+"""lambdavault: HashiCorp Vault on AWS Lambda + S3 + KMS. The vault CLI, hvac and the Terraform vault provider
+are the clients; this package is the helper around a deployment (`lambdavault status | output`)."""
+
+__version__ = "0.1.0"

lambdavault-0.1.0/lambdavault/__main__.py

@@ -0,0 +1,3 @@
+from .cli import main
+
+main()

lambdavault-0.1.0/lambdavault/cli.py

@@ -0,0 +1,87 @@
+"""lambdavault: the helper around a deployment. Day-to-day work (and `vault operator init`) is the vault CLI.
+
+    lambdavault output    export VAULT_ADDR=...: eval "$(lambdavault output)"
+    lambdavault status    is it up: initialized / sealed / version, and how long one call took
+
+The address comes from the deployment's local Terraform state (`terraform -chdir=terraform output -json`, run
+from the repo root), or from --addr / $VAULT_ADDR. Nothing is stored anywhere else.
+"""
+import argparse
+import json
+import os
+import subprocess
+import sys
+import time
+import urllib.error
+import urllib.request
+
+from . import __version__
+
+
+def address(args):
+    if args.addr:
+        return args.addr.rstrip("/")
+    try:
+        r = subprocess.run(["terraform", f"-chdir={args.dir}", "output", "-json"], capture_output=True, text=True)
+    except FileNotFoundError:
+        r = None
+    if r is None or r.returncode:
+        sys.exit(f"no address: run from the repo root after terraform apply, or give --addr / VAULT_ADDR "
+                 f"({(r.stderr.strip()[:200] if r else 'terraform not found')})")
+    out = json.loads(r.stdout or "{}")
+    if "vault_addr" not in out:
+        sys.exit(f"terraform output in {args.dir} has no vault_addr: deploy first (terraform -chdir={args.dir} apply)")
+    return out["vault_addr"]["value"]
+
+
+def call(addr, path, tries=5):
+    """GET one Vault API path. A cold start can take seconds and a busy function answers 429: wait and retry."""
+    for attempt in range(tries):
+        try:
+            with urllib.request.urlopen(addr + path, timeout=60) as r:
+                return r.status, json.loads(r.read() or b"{}")
+        except urllib.error.HTTPError as e:
+            if e.code in (429, 502, 503) and attempt < tries - 1:
+                time.sleep(1 + attempt)
+                continue
+            raw = e.read()
+            try:
+                return e.code, json.loads(raw)
+            except ValueError:
+                return e.code, {"errors": [raw.decode(errors="replace")[:200]]}
+    raise AssertionError("unreachable")
+
+
+def cmd_status(args):
+    addr = address(args)
+    t0 = time.time()
+    status, health = call(addr, "/v1/sys/health?uninitcode=200&sealedcode=200")
+    ms = (time.time() - t0) * 1000
+    if status != 200:
+        sys.exit(f"{addr} answered {status}: {health}")
+    print(f"{addr}\n"
+          f"  initialized {health.get('initialized')} · sealed {health.get('sealed')} · Vault {health.get('version')}\n"
+          f"  one call: {ms:.0f} ms (seconds after idle = a cold start) · UI: {addr}/ui/")
+    if not health.get("initialized"):
+        print(f"next: VAULT_ADDR={addr} vault operator init -recovery-shares=1 -recovery-threshold=1")
+
+
+def cmd_output(args):
+    print(f"export VAULT_ADDR={address(args)}")
+
+
+def main(argv=None):
+    p = argparse.ArgumentParser(prog="lambdavault", description=__doc__.split("\n\n")[0])
+    p.add_argument("--version", action="version", version=f"lambdavault {__version__}")
+    common = argparse.ArgumentParser(add_help=False)
+    common.add_argument("--dir", default="terraform", help="the Terraform directory (default terraform, from the repo root)")
+    common.add_argument("--addr", default=os.environ.get("VAULT_ADDR"), help="the Vault address instead of terraform output")
+    sub = p.add_subparsers(dest="command", required=True)
+    sub.add_parser("output", parents=[common], help="print export VAULT_ADDR=... (eval it)").set_defaults(func=cmd_output)
+    sub.add_parser("status", parents=[common], help="initialized / sealed / version / latency").set_defaults(func=cmd_status)
+    args = p.parse_args(argv)
+    args.func(args)
+
+
+if __name__ == "__main__":
+    main()

lambdavault-0.1.0/lambdavault.egg-info/PKG-INFO

@@ -0,0 +1,41 @@
+Metadata-Version: 2.4
+Name: lambdavault
+Version: 0.1.0
+Summary: HashiCorp Vault on AWS Lambda + S3 + KMS, ≈ $0 when idle. The vault CLI, hvac and the Terraform vault provider talk to it unchanged; this package is the helper: status, output.
+Author: Frank Zhang
+License: MIT
+Project-URL: Homepage, https://github.com/cloudformer/lambdavault
+Project-URL: Repository, https://github.com/cloudformer/lambdavault
+Project-URL: Deploy, https://github.com/cloudformer/lambdavault#quick-start
+Project-URL: Compatibility, https://github.com/cloudformer/lambdavault/blob/main/tests/compat/REPORT.md
+Project-URL: Changelog, https://github.com/cloudformer/lambdavault/blob/main/CHANGELOG.md
+Project-URL: Issues, https://github.com/cloudformer/lambdavault/issues
+Keywords: serverless,aws,lambda,vault,hashicorp-vault,secrets,kms
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+
+# lambdavault
+
+**HashiCorp Vault, truly serverless: the official Vault binary on AWS Lambda, data in S3, auto-unseal by KMS,
+≈ $1 a month when idle.** Part of [Redefine AWS Serverless](https://github.com/topics/redefine-aws-serverless).
+
+![lambdavault architecture](https://raw.githubusercontent.com/cloudformer/lambdavault/main/docs/architecture.svg)
+
+The vault CLI, hvac and the Terraform vault provider are the clients — unchanged, only `VAULT_ADDR` points at
+the Lambda. This package is the helper around a deployment:
+
+```bash
+pip install lambdavault
+lambdavault status    # initialized / sealed / version / latency (address from terraform output)
+eval "$(lambdavault output)"   # export VAULT_ADDR for the vault CLI
+vault operator init -recovery-shares=1 -recovery-threshold=1   # once
+vault kv get kvv2/app
+```
+
+Deploy the server from the [main repository](https://github.com/cloudformer/lambdavault) with Terraform.
+Compatibility with a normal Vault: [REPORT.md](https://github.com/cloudformer/lambdavault/blob/main/tests/compat/REPORT.md).

lambdavault-0.1.0/lambdavault.egg-info/SOURCES.txt

@@ -0,0 +1,10 @@
+README.md
+pyproject.toml
+lambdavault/__init__.py
+lambdavault/__main__.py
+lambdavault/cli.py
+lambdavault.egg-info/PKG-INFO
+lambdavault.egg-info/SOURCES.txt
+lambdavault.egg-info/dependency_links.txt
+lambdavault.egg-info/entry_points.txt
+lambdavault.egg-info/top_level.txt

lambdavault-0.1.0/lambdavault.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

lambdavault-0.1.0/lambdavault.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+lambdavault = lambdavault.cli:main

lambdavault-0.1.0/lambdavault.egg-info/top_level.txt

@@ -0,0 +1 @@
+lambdavault

lambdavault-0.1.0/pyproject.toml

@@ -0,0 +1,35 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "lambdavault"
+version = "0.1.0"
+description = "HashiCorp Vault on AWS Lambda + S3 + KMS, ≈ $0 when idle. The vault CLI, hvac and the Terraform vault provider talk to it unchanged; this package is the helper: status, output."
+readme = "README.md"
+requires-python = ">=3.9"
+license = { text = "MIT" }
+authors = [{ name = "Frank Zhang" }]
+keywords = ["serverless", "aws", "lambda", "vault", "hashicorp-vault", "secrets", "kms"]
+classifiers = [
+  "Development Status :: 3 - Alpha",
+  "Intended Audience :: Developers",
+  "License :: OSI Approved :: MIT License",
+  "Programming Language :: Python :: 3",
+  "Topic :: Security",
+]
+dependencies = []  # standard library only
+
+[project.scripts]
+lambdavault = "lambdavault.cli:main"
+
+[project.urls]
+Homepage = "https://github.com/cloudformer/lambdavault"
+Repository = "https://github.com/cloudformer/lambdavault"
+Deploy = "https://github.com/cloudformer/lambdavault#quick-start"
+Compatibility = "https://github.com/cloudformer/lambdavault/blob/main/tests/compat/REPORT.md"
+Changelog = "https://github.com/cloudformer/lambdavault/blob/main/CHANGELOG.md"
+Issues = "https://github.com/cloudformer/lambdavault/issues"
+
+[tool.setuptools]
+packages = ["lambdavault"]

lambdavault-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+