Skip to content

Commit

Permalink
updated enc example
Browse files Browse the repository at this point in the history
  • Loading branch information
daidokoro committed Mar 29, 2018
1 parent 1751ce7 commit c11b78d
Show file tree
Hide file tree
Showing 2 changed files with 13 additions and 7 deletions.
19 changes: 12 additions & 7 deletions examples/enc_vpc/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ The `vpc.yml` stack template file only has a single line which calls the `kms_de

--

Running `qaz generate -t template/vpc.yml` will return.
Running `qaz generate vpc` will return.

```yaml
Resources:
Expand All @@ -53,21 +53,26 @@ Outputs:

```

Note that this will only work for me, the Cipher Text Blob being used is linked to my AWS Account. You can encrypt your own values via KMS and switch the `.vpc.cipher` key in config to run tests.
__NOTE:__ This will only work for me, the Cipher Text Blob being used is linked to my AWS Account. You can encrypt your own values via KMS and switch the `.vpc.cipher` key in config to run tests.

If you do not adjust `.vpc.cipher` you'll see:
```
ERROR AccessDeniedException: The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access.
status code: 400, request id: 03654822-09d6-11e7-8beb-91d09effe97e request=generate
```



In the above a Deploy-Time `<< .vpc.cidr >>` resolver is used to populate the values from config to the template after the Gen-Time function decrypts it. With this, what we have is a fully encrypted template being decrypted and dynamically populated upon deployment to AWS.


This can be stored here in Github without worry as any attempts to deploy this outside of the AWS Acount the Cipher belongs to result in the followinh:
This can be stored here in Github without worry as any attempts to deploy this outside of the AWS Acount the Cipher belongs to result in the following:

```
[Mar 15 23:20:44] ERROR AccessDeniedException: The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access.
status code: 400, request id: 03654822-09d6-11e7-8beb-91d09effe97e request=generate
ERROR AccessDeniedException: The ciphertext refers to a customer master key that does not exist, does not exist in this region, or you are not allowed to access.
status code: 400, request id: 03654822-09d6-11e7-8beb-91d09effe97e request=generate
```


--

# Important
Expand Down
1 change: 1 addition & 0 deletions examples/enc_vpc/config.yml
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ project: encrypted

stacks:
vpc:
source: templates/vpc.yml
cf:
cidr: 10.10.10.0/24
cipher: |
Expand Down

0 comments on commit c11b78d

Please sign in to comment.