[go: up one dir, main page]
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Different AWS profiles are ignored when using multiple KMS keys #1468

Open
DrLuke opened this issue Mar 21, 2024 · 0 comments
Open

Different AWS profiles are ignored when using multiple KMS keys #1468

DrLuke opened this issue Mar 21, 2024 · 0 comments

Comments

@DrLuke
Copy link
DrLuke commented Mar 21, 2024 •
edited
Loading

I'm trying to use two KMS keys living in two different AWS accounts, so that each account can access the encrypted contents. Similar to the setup in #1093 .

I've created the following .sops.yaml:

---
creation_rules:
  - key_groups:
      - kms:
          - arn: arn:aws:kms:eu-central-1:ACCOUNT1:key/KEY1
            aws_profile: profile1
          - arn: arn:aws:kms:eu-central-1:ACCOUNT2:key/KEY2
            aws_profile: profile2

But when encrypting a file I get the following error:

error updating one or more master keys: [failed to encrypt new data key with master key "arn:aws:kms:eu-central-1:ACCOUNT2:key/KEY2": failed to encrypt sops data key with AWS KMS: operation error KMS: Encrypt, https response error StatusCode: 400, RequestID: [REDACTED], api error AccessDeniedException: User: arn:aws:sts::ACCOUNT1:assumed-role/[REDACTED] is not authorized to perform: kms:Encrypt on this resource because the resource does not exist in this Region, no resource-based policies allow access, or a resource-based policy explicitly denies access]

It seems to me like sops is using the default profile (which is profile1) instead of the defined profile.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@DrLuke