serverless framework and use key management service (KMS) - serverless-framework

Question

Basically I use serverless framework serverless for a function that allows me to send/receive emails through mailgun.
For this I have a config.js file set up in my serverless folder.
This config.js contains all my API keys, email address, login, etc for my “mailgun” function.
I want to use Google Cloud KMS to encrypt the resource config.js, because I am afraid my senstive data gets stolen and misused.
The encrypted file is config.js.enc. google_key_management_service
But serverless deploy does not decrypt my config.js.enc. It throws me a resource/syntax error…
Any solutions/ideas how I can make KMS work for my config.js file in my serverless framework?
I added AWS tags also, because they have a similar KMS as Google Cloud. But actually I think the real issue is with the serverless framework and to make encrypted files work in deploying serverless with sls deploy command, but I could be mistaken.

Answer 1

The serverless framework appears to include native AWS SSM integrations:
functions:
myfunc:
# other config
environment:
TWITTER_ACCESS_TOKEN: ${ssm:myFunc}
However, as you noted, there's no similar functionality on GCP, so you'll need to roll some of this on your own. You may be interested in some of the strategies outlined in Secrets in Serverless:
Do you need the secrets?
It's always important to ask - do I actually need these secrets? Could you leverage Cloud Provider IAM (or even cross-cloud OIDC) instead of injecting secrets into my application? Where possible, try to leverage the IAM solution provided by the various clouds. Obviously there are still quite a few cases where a secret is required.
Encrypted environment variables
Before the function is launched, you encrypt the plaintext secrets locally into ciphertext (encrypted strings). Here's an example with gcloud, but you can also use the API or other tools like HashiCorp Vault:
$ gcloud kms encrypt \
--ciphertext-file=- \
--plaintext-file=/path/to/my/secret \
--key=my-kms-key \
--key-ring=my-kms-keyring \
--location=us-east4 \
| base64
This will output a base64-encoded, encrypted string, which you then store in your config.js:
CiQAePa3VBJLbunLSqIJT+RS4nYiKdIaW6U69Y...
On startup, configure your application to:
Base64 decode the string
Decrypt the ciphertext using Cloud KMS
Store the plaintext in-memory for as long as the secret is needed
I'm not sure what language(s) you are using, but here's a nodejs sample. You can find a lot more samples on GitHub at sethvargo/secrets-in-serverless:
const cryptoKeyID = process.env.KMS_CRYPTO_KEY_ID;
const kms = require('#google-cloud/kms');
const client = new kms.v1.KeyManagementServiceClient();
let username;
client.decrypt({
name: cryptoKeyID,
ciphertext: process.env.DB_USER,
}).then(res => {
username = res[0].plaintext.toString().trim();
}).catch(err => {
console.error(err);
});
let password;
client.decrypt({
name: cryptoKeyID,
ciphertext: process.env.DB_PASS,
}).then(res => {
password = res[0].plaintext.toString().trim();
}).catch(err => {
console.error(err);
});
exports.F = (req, res) => {
res.send(`${username}:${password}`)
}
Google Cloud Storage
Since you're on GCP, another option is to use Google Cloud Storage (GCS) directly to store the secrets. This would remove your coupling from the serverless framework.
Make a bucket:
$ gsutil mb gs://${GOOGLE_CLOUD_PROJECT}-serverless-secrets
Make the bucket private:
$ gsutil defacl set private gs://${GOOGLE_CLOUD_PROJECT}-serverless-secrets
$ gsutil acl set -r private gs://${GOOGLE_CLOUD_PROJECT}-serverless-secrets
Write some secrets into the bucket. Even though they are being committed as plaintext, they are encrypted at rest, and access is tightly controlled via IAM.
$ gsutil -h 'Content-Type: application/json' cp - gs://${GOOGLE_CLOUD_PROJECT}-serverless-secrets/app1 <<< '{"username":"my-user", "password":"s3cr3t"}'
Then create a service account which has permission to read from the bucket, and assign that service account to your functions.
Finally, read from the bucket at function start (Python example this time):
import os
import json
from google.cloud import storage
blob = storage.Client() \
.get_bucket(os.environ['STORAGE_BUCKET']) \
.get_blob('app1') \
.download_as_string()
parsed = json.loads(blob)
username = parsed['username']
password = parsed['password']
def F(request):
return f'{username}:{password}'