Yet Another Tool - Vault

A CLI tool to manage application secrets, built with AWS SSM Support.

You can commit you configurations and encrypt your secrets, share the private key through AWS SSM Secure String and more !

Report Bug · Request Feature

About

• Generate Key Pair ('RSA')
• Create Empty secret file using a template
• Encrypt only your secure parameters
• Store all your configurations and commit them encrypted
• Use terminal editor and encrypt the changes automatically
• Use external editor and encrypt the changes manually
• Print the decrypted values on your screen
• Upload your key pair on AWS SSM (Only AWS SSM is supported for the moment, create a PR for more integrations)
• Sync your local configurations to AWS SSM
• Generate a .env file using your secrets
• Compatible with your CI, using the environment variables
• Made with NodeJS 18 and Typescript, built to be extended and improved
• Support override configurations and default values, it gives flexibility for local and cloud development setup. Provide simple way to standardize and use the same configuration across all machines and environments.

Installation

1npm install -g @yetanothertool/yat-vault

Usage

Create new Key Pair

1yat-vault --key-gen --key-name test

It creates a key pair named: Private Key: test.key and Public Key: test.pub

There is multiple ways to load the keys

Environment Variables

1export PRIVATE_KEY=$(cat test.key | base64)
2export PUBLIC_KEY=$(cat test.pub | base64)

or (Not Recommended)

1export PRIVATE_KEY=$(cat test.key)
2export PUBLIC_KEY=$(cat test.pub)

secret file

Update the following keys to use your local key pair:

• _configurations.publicKeyPath
• _configurations.privateKeyPath

Update the following keys to use your AWS key pair:

• _configurations.aws.publicKeyPath
  • This path must be a SSM path
• _configurations.aws.privateKeyPath
  • This path must be a SSM path
• _configurations.aws.awsRegion
  • This region must be the one containing the parameters

Create new Secret File

1mkdir vault/
2yat-vault --create --filename ./vault/test
3
4# or to create it in the current directory
5yat-vault --create --filename test

It generates an empty secret file named test.yml

The secret file structure

See the example directory.

The file is split in two main sections:

• _values
• _configurations

The _values section defined your values to save in the vault.
This is an array containing the parameter using this format:

1_values:
2  - name: /the/ssm/path/with/the/name/of/your/parameter
3    value: The Value to store or encrypt
4    description: an optional description
5    type: String|SecureString|StringList
6    overwrite: false
7    envName: The environment key to generate the .env file

You can use a concept of variables to dynamically set the name of your parameter.
To do so you must define the key/value in the _configurations.variables array.

1_values:
2  - name: /{tenant}/{project_name}/{stage}/password
3    value: my super password that will be encrypted
4    description: password is safe here
5    type: SecureString
6    overwrite: false
7    envName: The environment key to generate the .env file
8
9_configurations:
10  variables:
11    tenant: wl
12    project_name: yat-vault
13    stage: env:STAGE

The variables array contains the value for each key. They will be automatically replaced when syncing.
You can also use the environment variables.
You simply prepend: env: followed by the environment name.

AWS:

This object has the regions array, it let you deploy quickly using the multi region approach. the variable {region} automatically resolves to the current region, this way you can specify the region in the parameter name if needed.

Variables within values and overrides:

This feature must respect a format: ${my_variable:-defaultValue} or ${my_variable}. Very similar to bash

Where my_variable is the name used in your overrides file (See the Example) and defaultValue is the value to use in case that the override file isn't present or the variable isn't overidden.

The :- it means that the left part is the variable name and the right part the default value. This flag is optional. If not define, there is no default value, thus the variable will stay as-is

Character allowed:

• a-z and A-Z
• 0-9
• underscores ( _ )
• I didn't test other characters. I know that dashes ( - ) WON'T WORK.

The goal of this feature is to let developers configure their local environment quickly and easily and still use the same configuration that the cloud (or deployed) infrastructure has. This way the setup is self documented and the configuration follows everywhere.

Edit Secret File

1yat-vault --edit --filename test.yml

It opens vi to let you update your configuration, once you save the file, it automatically encrypt the new values.

As of V0.0.0, it doesn't refresh/encrypt everything if you change the key pair. DON'T change the key pair. You will get a weird behaviour.

Print Secret File Values

Be careful, this command expose all your secrets on your terminal !

1yat-vault --print --filename test.yml --overrides config.local.json

It decrypts and prints all values on your screen.
The --overrides filename.json let you use the variables see above for more details

Encrypt Secret File

You don't have vi; You don't like vi; No problem.
This command encrypt your file.

1yat-vault --encrypt --filename test.yml

Upload your Key pair

This command saves your key pair in AWS, using the configuration defined in the secret file. You must specify an AWS region (Currently, only AWS is supported)

1yat-vault --upload --filename test.yml --region ca-central-1 --provider aws

This way your CI, developers and etc can use the secrets without sharing the password.

If you setup a passphrase, you will have to share it for now.

Sync Your local secrets to your provider

To sync your local values to the cloud

1yat-vault --sync --filename test.yml

The overwrite option determines if you can overwrite the values in SSM.
This command is verbose to let you know what is going on.

Generate .env file

1yat-vault --dotenv --filename test.yml --env .env.test --overrides config.local.json

The envName in the secret file, determines the Key of your parameter.
The --overrides filename.json let you use the variables see above for more details

Values and Variables - Overrides and Defaults

The simplest way to explain that feature is to look this example:

• config.local.json
• vault.urls.yml

Then these commands:

1yat-vault --print --filename example/vault.urls.yml --overrides example/local.config.json
2yat-vault --print --filename example/vault.urls.yml
3yat-vault --dotenv --filename example/vault.urls.yml --overrides example/local.config.json --env example/.env.local
4cat example/.env.local
5yat-vault --dotenv --filename example/vault.urls.yml --env example/.env.local
6cat example/.env.local

It allows you to specify varibales with optional default values. Then you can define a JSON to set the values. For more details Create new Secret File

Environment Variables

Changelog

The TODO

V1.2.3 - Beta - 2023-07-12

• Added concept of local variables (--dotenv) (to define environment variables only), this way it setup the local machine and skip the sync process while syncing with SSM (the --sync command).

Contributing

1. Create a Feature Branch
2. Commit your changes
3. Push your changes
4. Create a PR

1git checkout -b <feature|fix|release|chore|hotfix>/prefix-name

1git fetch origin
2git rebase origin/master

1git add .
2git commit -m "<feat|ci|test|docs|build|chore|style|refactor|perf|BREAKING CHANGE>: commit message"

1git push origin <feature|fix|release|chore|hotfix>/prefix-name

1git checkout -b release/v1.15.5
2git checkout -b feature/abc-123-something-awesome
3git checkout -b hotfix/abc-432-something-bad-to-fix

1git commit -m "docs: added awesome documentation"
2git commit -m "feat: added new feature"
3git commit -m "test: added tests"

Local Development

1npm install
2npm run build

License

Distributed under the MIT License. See LICENSE for more information.

Contact

• Tommy Gingras @ tommy@studiowebux.com | Studio Webux

| | Webux Lab |