Skip to content

Add AWS Secrets Manager/KMS node key support - #129

Merged
YoshihitoAso merged 5 commits into
dev-2.7from
aws-kms-feature
Mar 16, 2026
Merged

Add AWS Secrets Manager/KMS node key support#129
YoshihitoAso merged 5 commits into
dev-2.7from
aws-kms-feature

Conversation

@YoshihitoAso

Copy link
Copy Markdown
Member

This pull request introduces support for securely managing P2P node keys using AWS Secrets Manager and optional AWS KMS decryption, allowing node keys to be fetched and decrypted at runtime rather than stored directly on disk. The changes include new CLI flags, TOML configuration options, and the implementation of fetcher and decrypter logic for AWS-based node key management. Documentation and tests are also added to ensure correct usage and behavior.

AWS Node Key Management Integration

  • Added support for fetching node keys from AWS Secrets Manager and decrypting them with AWS KMS, including new fetcher (NodeKeyAwsSecretsManagerFetcher) and decrypter (NodeKeyAwsKmsDecrypter) implementations. [1] [2]
  • Introduced a Manager class to coordinate node key retrieval and decryption based on CLI and TOML configuration, supporting both plaintext and encrypted flows.
  • Created AwsClient utility for initializing AWS SDK clients and validating configuration.

CLI and Configuration Enhancements

  • Added new CLI flags --nodekeysource and --nodekeydecryption to select node key source and decryption scheme, defaulting to file/plaintext but supporting AWS flows. [1] [2]
  • Extended TOML configuration to allow specifying AWS secret name, version, KMS key ID, and encryption algorithm. [1] [2]
  • Updated setNodeKey logic in flags.go to handle new source/decryption flows, with legacy flags taking precedence.

Documentation

  • Added docs/aws-nodekey.md and updated README.md to describe AWS node key management, CLI options, configuration, and IAM requirements.

Add support for loading P2P node keys from AWS Secrets Manager with optional AWS KMS decryption.
Update repository to use Go 1.25.8
Comment thread cmd/utils/nodekey/fetcher/aws_sm.go
@YoshihitoAso
YoshihitoAso merged commit 3dd49c4 into dev-2.7 Mar 16, 2026
5 checks passed
@YoshihitoAso
YoshihitoAso deleted the aws-kms-feature branch March 16, 2026 04:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants