getsops/sops

SOPS is an editor of encrypted files that supports YAML, JSON, ENV, INI and BINARY formats and encrypts with AWS KMS, GCP KMS, Azure Key Vault, age, and PGP. (demo <https://www.youtube.com/watch?v=YTEVyLXFiq0>_)

For the adventurous, unstable features are available in the main branch, which you can install from source:

If you don't have Go installed, set it up with:

Or whatever variation of the above fits your system and shell.

To use SOPS as a library, take a look at the decrypt package <https://pkg.go.dev/github.com/getsops/sops/v3/decrypt>_.

.. sectnum:: .. contents:: Table of Contents

For a quick presentation of SOPS, check out this Youtube tutorial:

If you're using AWS KMS, create one or multiple master keys in the IAM console and export them, comma separated, in the SOPS_KMS_ARN env variable. It is recommended to use at least two master keys in different regions.

SOPS uses aws-sdk-go-v2 <https://github.com/aws/aws-sdk-go-v2>_ to communicate with AWS KMS. It will automatically read the credentials from the ~/.aws/credentials file which can be created with the aws configure command.

An example of the ~/.aws/credentials file is shown below:

In addition to the ~/.aws/credentials file, you can also use the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables to specify your credentials:

For more information and additional environment variables, see specifying credentials <https://aws.github.io/aws-sdk-go-v2/docs/configuring-sdk/#specifying-credentials>_.