Encryption of environment variables

Secret values can be passed to environment variables using SSM or KMS.

When using SSM

First, register string in SSM parameter store.

• https://docs.aws.amazon.com/cli/latest/reference/ssm/put-parameter.html

SSM parameter can be specified in environment of task definition.

container_definitions:
  - name: web
    secrets:
      - name: MYSQL_PASSWORD
        value_from: production/database/password/master

When using KMS

Embedding of KMS keys to encrypt secret values is deprecated. Use of SSM parameter store is recommended.

秘密の値を暗号化するためのKMS鍵の埋め込みは非推奨です。SSMパラメータストアの使用を推奨します。 First, create KMS alias key for encryption.

• https://docs.aws.amazon.com/cli/latest/reference/kms/create-key.html
• https://docs.aws.amazon.com/cli/latest/reference/kms/create-alias.html

# Encrypt
$ docker-compose run --rm rails thor genova:env encrypt --master-key=[KMS ALIAS NAME] --value=[VALUE]
Encrypted value: ${...}

# Decrypt
$ docker-compose run --rm rails thor genova:env decrypt --value='${...}'
Decrypted value: xxx

Encrypted value can be specified in environment of task definition.

container_definitions:
  - name: web
    environemnt:
      - name: MYSQL_PASSWORD
        value: ${...}