noy-db
stable

aws-kms

Seals the managed-secret vault key via AWS KMS Encrypt/Decrypt, with CloudTrail logging every vault open.

@noy-db/at-aws-kms · pnpm add @noy-db/at-aws-kms Cloud-KMS sealing — the key lives in AWS KMS, access controlled by IAM.

What it does

atAwsKms({ keyId }) seals and unseals the hub-generated managed-mode secret via authenticated KMS Encrypt/Decrypt calls, so CloudTrail records every time a user's vault is opened with no extra instrumentation. Its pid is aws-kms:<keyId> (e.g. aws-kms:arn:aws:kms:us-east-1:123456789012:key/abc). Credentials resolve through the SDK's ambient chain (IAM role, env vars, ~/.aws/credentials) — never pass raw credentials in the options; inject a pre-built client instead for tests or non-default auth. KMS supports automatic rotation for symmetric keys with no app-side changes.

The package also exports awsKmsRecipientSealer(), an asymmetric recipient-target extension of the same host: a grantor seals bytes locally against the host's published RSA public key with no KMS call and no AWS credentials, and only the host (via KMS Decrypt) can open them. This is the building block for record-scoped sealing to a host — see sealed-record.

Usage

import { atAwsKms } from '@noy-db/at-aws-kms'

const sealingKey = atAwsKms({
  keyId: 'arn:aws:kms:us-east-1:123456789012:key/abc',
})
sealingKey.id // → 'aws-kms:arn:aws:kms:us-east-1:123456789012:key/abc'

See also

at-Seals

azure-keyvault