Skip to content

Latest commit

 

History

History
45 lines (38 loc) · 1.57 KB

README.md

File metadata and controls

45 lines (38 loc) · 1.57 KB

cfnencrypt

AWS CloudFormation Custom Resource to encrypt strings using AWS KMS.

Introduction

At the moment of this writing, there's no way to create a AWS::SSM::Parameter with a "SecureString" type (doc). This is just a workaround that limitation, use it at your own risk.

Wishful thinking, having a CloudFormation intrinsic function for this (Fn::EncryptString).

Custom Resource

Properties

  • KeyId: KMS Key Id
  • String: String to be encrypted using KMS

Return Values

  • EncryptedString: Base64 encoded CiphertextBlob

Usage

Custom Resource

  • You'll have to declare a custom resource per encrypted string
  EncryptedServicePassword:
    Type: Custom::StringEncryption
    Properties:
      ServiceToken: !GetAtt LambdaEncryptionHelper.Arn
      KeyId: !Ref KMSHelperKey
      String: !Ref ExampleParameter
  ServicePasswordEncryptedSSMParameter:
    Type: 'AWS::SSM::Parameter'
    Properties:
      Description: Service Password Encrypted SSM Parameter
      Type: String
      Value: !GetAtt EncryptedServicePassword.EncryptedString

Installation

  • Include the following resources from the supplied template(custom-resource-encrypt.yaml) in your CloudFormation template
    • LambdaEncryptionHelper
    • LambdaEncryptionHelperRole
    • KMSHelperKey

Usage

  • Declare a custom resource with the following properties:
    • ServiceToken: !GetAtt LambdaEncryptionHelper.Arn
    • KeyId: !Ref KMSHelperKey
    • String: <whatever you want>