{"id":13820851,"url":"https://github.com/nplutt/pydantic-kms-secrets","last_synced_at":"2025-05-16T10:33:12.695Z","repository":{"id":62579755,"uuid":"280575229","full_name":"nplutt/pydantic-kms-secrets","owner":"nplutt","description":"Utility to decrypt and encrypt secrets using AWS KMS keys that also integrates with pydantic models which allows for encrypted values to be stored in .env files and be decrypted at runtime","archived":false,"fork":false,"pushed_at":"2020-08-16T17:36:45.000Z","size":34,"stargazers_count":2,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"master","last_synced_at":"2024-05-30T01:03:46.754Z","etag":null,"topics":["aws","environment-variables","kms","pydantic","secrets","secrets-management"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nplutt.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-07-18T03:41:21.000Z","updated_at":"2024-02-29T17:20:01.000Z","dependencies_parsed_at":"2022-11-03T21:00:52.406Z","dependency_job_id":null,"html_url":"https://github.com/nplutt/pydantic-kms-secrets","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nplutt%2Fpydantic-kms-secrets","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nplutt%2Fpydantic-kms-secrets/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nplutt%2Fpydantic-kms-secrets/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nplutt%2Fpydantic-kms-secrets/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nplutt","download_url":"https://codeload.github.com/nplutt/pydantic-kms-secrets/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225423739,"owners_count":17472178,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","environment-variables","kms","pydantic","secrets","secrets-management"],"created_at":"2024-08-04T08:01:10.373Z","updated_at":"2024-11-19T20:31:29.568Z","avatar_url":"https://github.com/nplutt.png","language":"Python","funding_links":[],"categories":["Python"],"sub_categories":[],"readme":"# pydantic-kms-secrets\n[![PyPI version](https://badge.fury.io/py/pydantic-kms-secrets.svg)](https://badge.fury.io/py/pydantic-kms-secrets)\n![Upload Python Package](https://github.com/nplutt/pydantic-kms-secrets/workflows/Upload%20Python%20Package/badge.svg)\n[![codecov](https://codecov.io/gh/nplutt/pydantic-kms-secrets/branch/master/graph/badge.svg)](https://codecov.io/gh/nplutt/pydantic-kms-secrets)\n\nUtility to decrypt and encrypt secrets using [AWS KMS keys](https://aws.amazon.com/kms/) \nthat also integrates with [pydantic](https://pydantic-docs.helpmanual.io/) models which allows for\nencrypted values to be stored in `.env` files and be decrypted at runtime.\n\n## Installation\nFrom PyPi:\n```bash\n$ pip install pydantic-kms-secrets\n```\n\n## Usage\n\n### CLI\nEncrypt a secret:\n```bash\n$ pks -k your-kms-key-id -v my-secret-password -e\n```\n\nDecrypt a secret:\n```bash\n$ pks -k your-kms-key-id -v your-encrypted-secret -d\n```\n\nHelp docs:\n```bash\n$ pks --help\nusage: pks [-h] [-k KEY_ID] -v VALUE [-e] [-d]\n\nTool to encrypt and decrypt secrets via a KMS key\n\noptional arguments:\n  -h, --help            show this help message and exit\n  -k KEY_ID, --key-id KEY_ID\n                        ID of the KMS key to use\n  -v VALUE, --value VALUE\n                        The value to be encrypted\n  -e, --encrypt         Set to encrypt value\n  -d, --decrypt         Set to decrypt value\n```\n\n### Pydantic\nPydantic KMS Secrets is able to integrate and add functionality on top of Pydantic's \n[dotenv extension](https://pydantic-docs.helpmanual.io/usage/settings/) by allowing you\nto store encrypted values in your `.env` files and decrypt them at runtime. A basic implementation\nwould look something like: \n\n**Pydantic Settings Model**\n```python\nfrom pydantic import BaseSettings\nfrom pydantic_kms_secrets import KMSSecretStr, decrypt_kms_secrets\n\n\nclass Settings(BaseSettings):\n    env: str\n    secrets_kms_key_id: str  # This model attribute must exist to decrypt secrets\n    kms_secret_1: KMSSecretStr\n    kms_secret_2: KMSSecretStr\n\n    class Config:\n        env_file = \".env\"\n\n# Don't forget to call decrypt_kms_secrets, if you don't the secrets will not be decrypted\nsettings = decrypt_kms_secrets(Settings())\n```\n\n**`.env` File**\n```bash\nENV=\"prod\"\n\nSECRETS_KMS_KEY_ID=\"your-kms-key-id\"  # This environment variable must be set to decrypt secrets\nKMS_SECRET_1=\"my-first-encrypted-secret\"\nKMS_SECRET_2=\"my-second-encrypted-secret\"\n```\n\n**KMSSecretStr** Class\n\nThe `KMSSecretStr` class is almost identical to the [SecretStr](https://pydantic-docs.helpmanual.io/usage/types/#secret-types)\ntype in pydantic. \n```python\n# This example uses the settings value from the python example above\n\n# Standard access methods will not display the secret\nprint(settings)\n#\u003e env='prod' secrets_kms_key_id='your-kms-key-id' kms_secret_1=KMSSecretStr('**********') kms_secret_2=KMSSecretStr('**********')\nprint(settings.kms_secret_1)\n#\u003e **********\nprint(settings.dict())\n\"\"\"\n{\n    'env': 'prod',\n    'secret_kms_key_id': 'your-kms-key-id',\n    'kms_secret_1': KMSSecretStr('**********'),\n    'kms_secret_2': KMSSecretStr('**********'),\n}\n\"\"\"\nprint(settings.json())\n#\u003e {\"env\": \"prod\", \"secret_kms_key_id\": \"your-kms-key-id\", \"kms_secret_1\": \"**********\", \"kms_secret_2\": \"**********\"}\n\n# Use get_secret_value method to see the secret's content.\nprint(settings.kms_secret_1.get_secret_value())\n#\u003e my-first-encrypted-secret\nprint(settings.kms_secret_2.get_secret_value())\n#\u003e my-second-encrypted-secret\n```\n \n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnplutt%2Fpydantic-kms-secrets","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnplutt%2Fpydantic-kms-secrets","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnplutt%2Fpydantic-kms-secrets/lists"}