SOPS

https://getsops.io/docs
Admin
SOPS (Secrets OPerationS) is an editor of encrypted files that supports YAML, JSON, ENV, INI, and...
Tokens:18,873
Snippets:210
Trust Score:7.6
Update:2 months ago
Show doc for...
Tokens:
Raw
### Install Go and configure environment

Source: https://getsops.io/docs/installation

Commands to install the Go compiler and set up the GOPATH environment variable.

```bash
$ {apt,yum,brew} install golang
$ echo 'export GOPATH=~/go' >> ~/.bashrc
$ source ~/.bashrc
$ mkdir $GOPATH
```

--------------------------------

### Build SOPS from source

Source: https://getsops.io/docs/installation

Commands to clone the repository and install the development version. Requires Go version 1.25 or higher.

```bash
$ mkdir -p $GOPATH/src/github.com/getsops/sops/
$ git clone https://github.com/getsops/sops.git $GOPATH/src/github.com/getsops/sops/
$ cd $GOPATH/src/github.com/getsops/sops/
$ make install
```

--------------------------------

### Configure PGP key fingerprint creation rules

Source: https://getsops.io/docs/reference

Example of specifying PGP/GPG key fingerprints for encryption.

```yaml

creation_rules:
  - pgp:
      - 85D77543B3D624B63CEA9E6DBC17301B491B3F21!
      - E60892BB9BD89A69F759A1A0A3D652173B763E8F!

```

--------------------------------

### AWS Credentials File Format

Source: https://getsops.io/docs/usage/first-steps

Example structure for the ~/.aws/credentials file used by the AWS SDK.

```ini
$ cat ~/.aws/credentials
[default]
aws_access_key_id = AKI.....
aws_secret_access_key = mw......
```

--------------------------------

### Configure Age public key creation rules

Source: https://getsops.io/docs/reference

Example of specifying a list of Age public keys for encryption.

```yaml

creation_rules:
  - age:
      - age1s3cqcks5genc6ru8chl0hkkd04zmxvczsvdxq99ekffe4gmvjpzsedk23c
      - age1qe5lxzzeppw5k79vxn3872272sgy224g2nzqlzy3uljs84say3yqgvd0sw

```

--------------------------------

### Test SOPS with repository PGP keys

Source: https://getsops.io/docs/usage/identities/pgp

Clone the repository and import the functional test key to decrypt the example configuration file.

```bash
$ git clone https://github.com/getsops/sops.git
$ cd sops
$ gpg --import pgp/sops_functional_tests_key.asc
$ sops edit example.yaml
```

--------------------------------

### KMS Key Policy Example

Source: https://getsops.io/docs/usage/identities/amazon-aws-kms

An example IAM policy allowing the specified role to perform KMS operations.

```json

{
  "Sid": "Allow use of the key",
  "Effect": "Allow",
  "Action": [
    "kms:Encrypt",
    "kms:Decrypt",
    "kms:ReEncrypt*",
    "kms:GenerateDataKey*",
    "kms:DescribeKey"
  ],
  "Resource": "*",
  "Principal": {
    "AWS": [
      "arn:aws:iam::927034868273:role/sops-dev-xyz"
    ]
  }
}

```

--------------------------------

### Deploy Local Vault Instance

Source: https://getsops.io/docs/usage/identities/hashicorp-vault-openbao

Starts a local development Vault instance using Docker. Do not use this configuration for production environments.

```bash
$ docker run -d -p8200:8200 vault:1.2.0 server -dev -dev-root-token-id=toor
```

--------------------------------

### Configure GCP KMS creation rules

Source: https://getsops.io/docs/reference

Example of specifying a GCP KMS ResourceID for encryption.

```yaml

creation_rules:
  - gcp_kms:
      - projects/mygcproject/locations/global/keyRings/mykeyring/cryptoKeys/thekey

```

--------------------------------

### Configure HashiCorp Vault transit URI creation rules

Source: https://getsops.io/docs/reference

Example of specifying a HashiCorp Vault transit URI.

```yaml

creation_rules:
  - hc_vault_transit_uri:
      - http://my.vault/v1/sops/keys/secondkey

```

--------------------------------

### Configure Azure Key Vault creation rules

Source: https://getsops.io/docs/reference

Example of specifying Azure Key Vault resource identifiers, with or without versioning.

```yaml

creation_rules:
  - azure_keyvault:
      - https://vault.url/keys/key-name/key-version  # Key with version
      - https://vault.url/keys/key-name/             # key without version, the latest will be used

```

--------------------------------

### Publishing to HashiCorp Vault

Source: https://getsops.io/docs/usage/publishing

Example workflow for authenticating with Vault and publishing a file using the sops publish command.

```bash
$ export VAULT_TOKEN=...
$ export VAULT_ADDR='http://127.0.0.1:8200'
$ sops decrypt vault/test.yaml
example_string: bar
example_number: 42
example_map:
    key: value
$ sops publish vault/test.yaml
uploading /home/user/sops_directory/vault/test.yaml to http://127.0.0.1:8200/v1/secret/data/sops/test.yaml ? (y/n): y
$ vault kv get secret/sops/test.yaml
====== Metadata ======
Key              Value
---              -----
created_time     2019-07-11T03:32:17.074792017Z
deletion_time    n/a
destroyed        false
version          3

========= Data =========
Key               Value
---               -----
example_map       map[key:value]
example_number    42
example_string    bar
```

--------------------------------

### PGP Encryption Metadata Example

Source: https://getsops.io/docs/reference

Example of the SOPS metadata structure when using PGP for data key encryption.

```yaml
sops:
    pgp:
        - fp: 85D77543B3D624B63CEA9E6DBC17301B491B3F21
          created_at: 1441570391.930042
          enc: |
              -----BEGIN PGP MESSAGE-----
              Version: GnuPG v1

              hQIMA0t4uZHfl9qgAQ//UvGAwGePyHuf2/zayWcloGaDs0MzI+zw6CmXvMRNPUsA
              pAgRKczJmDu4+XzN+cxX5Iq9xEWIbny9B5rOjwTXT3qcUYZ4Gkzbq4MWkjuPp/Iv
              qO4MJaYzoH5YxC4YORQ2LvzhA2YGsCzYnljmatGEUNg01yJ6r5mwFwDxl4Nc80Cn
              RwnHuGExK8j1jYJZu/juK1qRbuBOAuruIPPWVdFB845PA7waacG1IdUW3ZtBkOy3
              O0BIfG2ekRg0Nik6sTOhDUA+l2bewCcECI8FYCEjwHm9Sg5cxmP2V5m1mby+uKAm
              kewaoOyjbmV1Mh3iI1b/AQMr+/6ZE9MT2KnsoWosYamFyjxV5r1ZZM7cWKnOT+tu
              KOvGhTV1TeOfVpajNTNwtV/Oyh3mMLQ0F0HgCTqomQVqw5+sj7OWAASuD3CU/dyo
              pcmY5Qe0TNL1JsMNEH8LJDqSh+E0hsUxdY1ouVsg3ysf6mdM8ciWb3WRGxih1Vmf
              unfLy8Ly3V7ZIC8EHV8aLJqh32jIZV4i2zXIoO4ZBKrudKcECY1C2+zb/TziVAL8
              qyPe47q8gi1rIyEv5uirLZjgpP+JkDUgoMnzlX334FZ9pWtQMYW4Y67urAI4xUq6
              /q1zBAeHoeeeQK+YKDB7Ak/Y22YsiqQbNp2n4CKSKAE4erZLWVtDvSp+49SWmS/S
              XgGi+13MaXIp0ecPKyNTBjF+NOw/I3muyKr8EbDHrd2XgIT06QXqjYLsCb1TZ0zm
              xgXsOTY3b+ONQ2zjhcovanDp7/k77B+gFitLYKg4BLZsl7gJB12T8MQnpfSmRT4=
              =oJgS
              -----END PGP MESSAGE-----
```

--------------------------------

### Configure AWS KMS creation rules

Source: https://getsops.io/docs/reference

Example of defining AWS KMS keys and an optional AWS profile within a creation rule.

```yaml

creation_rules:
  - kms:
      - arn:aws:kms:us-east-1:656532927350:key/920aff2e-c5f1-4040-943a-047fa387b27e
      - arn:aws:kms:ap-southeast-1:656532927350:key/9006a8aa-0fa6-4c14-930e-a2dfb916de1d
    aws_profile: foo

```

--------------------------------

### Configure HuaweiCloud KMS creation rules

Source: https://getsops.io/docs/reference

Example of specifying HuaweiCloud KMS key IDs using the region:key-uuid format.

```yaml

creation_rules:
  - hckms:
      - tr-west-1:abc12345-6789-0123-4567-890123456789
      - tr-west-1:def67890-1234-5678-9012-345678901234

```

--------------------------------

### KMS Encryption Metadata Example

Source: https://getsops.io/docs/reference

Example of the SOPS metadata structure when using AWS KMS for data key encryption.

```yaml
sops:
    kms:
        - enc: CiC6yCOtzsnFhkfdIslYZ0bAf//gYLYCmIu87B3sy/5yYxKnAQEBAQB4usgjrc7JxYZH3SLJWGdGwH//4GC2ApiLvOwd7Mv+cmMAAAB+MHwGCSqGSIb3DQEHBqBvMG0CAQAwaAYJKoZIhvcNAQcBMB4GCWCGSAFlAwQBLjARBAyGdRODuYMHbA8Ozj8CARCAO7opMolPJUmBXd39Zlp0L2H9fzMKidHm1vvaF6nNFq0ClRY7FlIZmTm4JfnOebPseffiXFn9tG8cq7oi
          enc_ts: 1439568549.245995
          arn: arn:aws:kms:us-east-1:656532927350:key/920aff2e-c5f1-4040-943a-047fa387b27e
```

--------------------------------

### Configure complex key groups and merge rules

Source: https://getsops.io/docs/reference

Example of defining multiple key groups and merge strategies for advanced encryption requirements.

```yaml

creation_rules:
  - key_groups:
      - kms:
          - arn:aws:kms:us-east-1:656532927350:key/920aff2e-c5f1-4040-943a-047fa387b27e
          - arn:aws:kms:ap-southeast-1:656532927350:key/9006a8aa-0fa6-4c14-930e-a2dfb916de1d
        aws_profile: foo
        age:
          - age1s3cqcks5genc6ru8chl0hkkd04zmxvczsvdxq99ekffe4gmvjpzsedk23c
          - age1qe5lxzzeppw5k79vxn3872272sgy224g2nzqlzy3uljs84say3yqgvd0sw
        pgp:
          - 85D77543B3D624B63CEA9E6DBC17301B491B3F21!
          - E60892BB9BD89A69F759A1A0A3D652173B763E8F!
        gcp_kms:
          - projects/mygcproject/locations/global/keyRings/mykeyring/cryptoKeys/thekey
        azure_keyvault:
          - https://vault.url/keys/key-name/key-version  # Key with version
          - https://vault.url/keys/key-name/             # key without version, the latest will be used
        hc_vault_transit_uri:
          - http://my.vault/v1/sops/keys/secondkey
        hckms:
          - tr-west-1:abc12345-6789-0123-4567-890123456789

        merge:
          - pgp:
              - 85D77543B3D624B63CEA9E6DBC17301B491B3F21!
          - age:
              - age1s3cqcks5genc6ru8chl0hkkd04zmxvczsvdxq99ekffe4gmvjpzsedk23c
          - gcp_kms:
              - projects/mygcproject/locations/global/keyRings/mykeyring/cryptoKeys/thekey
            azure_keyvault:
              - https://vault.url/keys/key-name/key-version

```

--------------------------------

### Encrypted File Structure

Source: https://getsops.io/docs/usage/first-steps

Example of how an encrypted file appears with KMS and PGP metadata blocks.

```yaml
myapp1: ENC[AES256_GCM,data:Tr7o=,iv:1=,aad:No=,tag:k=]
app2:
    db:
        user: ENC[AES256_GCM,data:CwE4O1s=,iv:2k=,aad:o=,tag:w==]
        password: ENC[AES256_GCM,data:p673w==,iv:YY=,aad:UQ=,tag:A=]
    # private key for secret operations in app2
    key: |-
        ENC[AES256_GCM,data:Ea3kL5O5U8=,iv:DM=,aad:FKA=,tag:EA==]
an_array:
    - ENC[AES256_GCM,data:v8jQ=,iv:HBE=,aad:21c=,tag:gA==]
    - ENC[AES256_GCM,data:X10=,iv:o8=,aad:CQ=,tag:Hw==]
    - ENC[AES256_GCM,data:KN=,iv:160=,aad:fI4=,tag:tNw==]
sops:
    kms:
        - created_at: 1441570389.775376
          enc: CiC....Pm1Hm
          arn: arn:aws:kms:us-east-1:656532927350:key/920aff2e-c5f1-4040-943a-047fa387b27e
        - created_at: 1441570391.925734
          enc: Ci...awNx
          arn: arn:aws:kms:ap-southeast-1:656532927350:key/9006a8aa-0fa6-4c14-930e-a2dfb916de1d
    pgp:
        - fp: 85D77543B3D624B63CEA9E6DBC17301B491B3F21
          created_at: 1441570391.930042
          enc: |
              -----BEGIN PGP MESSAGE-----
              hQIMA0t4uZHfl9qgAQ//UvGAwGePyHuf2/zayWcloGaDs0MzI+zw6CmXvMRNPUsA
              ...=oJgS
              -----END PGP MESSAGE-----
```

--------------------------------

### Unsupported YAML Anchors

Source: https://getsops.io/docs/reference

Example of a YAML file structure that fails in SOPS due to anchor usage.

```yaml
bill-to:  &id001
    street: |
        123 Tornado Alley
        Suite 16
    city:   East Centerville
    state:  KS

ship-to:  *id001
```

--------------------------------

### KMS Policy with Encryption Context Condition

Source: https://getsops.io/docs/usage/identities/amazon-aws-kms

An IAM policy example that restricts access based on specific encryption context keys and values.

```json

{
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::111122223333:role/RoleForExampleApp"
  },
  "Action": "kms:Decrypt",
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "kms:EncryptionContext:AppName": "ExampleApp",
      "kms:EncryptionContext:FilePath": "/var/opt/secrets/"
    }
  }
}

```

--------------------------------

### Configure HuaweiCloud credentials via file

Source: https://getsops.io/docs/usage/identities/huaweicloud-kms

Create a credentials file at ~/.huaweicloud/credentials with the specified format.

```bash
$ cat ~/.huaweicloud/credentials
[default]
ak = your-access-key
sk = your-secret-key
project_id = your-project-id
```

--------------------------------

### Create a new encrypted file

Source: https://getsops.io/docs/usage/identities/config-file

Initialize a new file using the rules defined in the configuration file.

```bash
$ sops edit <newfile>.prod.yaml
```

--------------------------------

### Clone the documentation repository

Source: https://getsops.io/docs/contribution-guidelines

Use this command to create a local copy of the documentation repository for local development.

```bash
git clone --depth 1 https://github.com/getsops/docs.git
```

--------------------------------

### Configure HuaweiCloud credentials via environment variables

Source: https://getsops.io/docs/usage/identities/huaweicloud-kms

Set the required access key, secret key, and project ID as environment variables for authentication.

```bash
export HUAWEICLOUD_SDK_AK="your-access-key"
export HUAWEICLOUD_SDK_SK="your-secret-key"
export HUAWEICLOUD_SDK_PROJECT_ID="your-project-id"
```

--------------------------------

### Create a new encrypted file

Source: https://getsops.io/docs/usage/common-operations

Initializes a new file with data encrypted using specified KMS and PGP keys.

```bash
$ sops edit --kms "arn:aws:kms:us-west-2:927034868273:key/fe86dd69-4132-404c-ab86-4269956b4500" --pgp C9CAB0AF1165060DB58D6D6B2653B624D620786D /path/to/new/file.yaml
```

--------------------------------

### Define creation rules in .sops.yaml

Source: https://getsops.io/docs/usage/identities/config-file

This configuration file defines rules for different file patterns using regex. Rules are evaluated sequentially, and the first match wins.

```yaml
# creation rules are evaluated sequentially, the first match wins
creation_rules:
    # upon creation of a file that matches the pattern *.dev.yaml,
    # KMS set A as well as PGP and age is used
    - path_regex: \.dev\.yaml$
      kms: 'arn:aws:kms:us-west-2:927034868273:key/fe86dd69-4132-404c-ab86-4269956b4500,arn:aws:kms:us-west-2:361527076523:key/5052f06a-5d3f-489e-b86c-57201e06f31e+arn:aws:iam::361527076523:role/hiera-sops-prod'
      pgp: 'FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4'
      age: 'age129h70qwx39k7h5x6l9hg566nwm53527zvamre8vep9e3plsm44uqgy8gla'

    # prod files use KMS set B in the PROD IAM, PGP and age
    - path_regex: \.prod\.yaml$
      kms: 'arn:aws:kms:us-west-2:361527076523:key/5052f06a-5d3f-489e-b86c-57201e06f31e+arn:aws:iam::361527076523:role/hiera-sops-prod,arn:aws:kms:eu-central-1:361527076523:key/cb1fab90-8d17-42a1-a9d8-334968904f94+arn:aws:iam::361527076523:role/hiera-sops-prod'
      pgp: 'FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4'
      age: 'age129h70qwx39k7h5x6l9hg566nwm53527zvamre8vep9e3plsm44uqgy8gla'
      hc_vault_uris: "http://localhost:8200/v1/sops/keys/thirdkey"

    # gcp files using GCP KMS
    - path_regex: \.gcp\.yaml$
      gcp_kms: projects/mygcproject/locations/global/keyRings/mykeyring/cryptoKeys/thekey

    # hckms files using HuaweiCloud KMS
    - path_regex: \.hckms\.yaml$
      hckms: tr-west-1:abc12345-6789-0123-4567-890123456789,tr-west-2:def67890-1234-5678-9012-345678901234

    # Finally, if the rules above have not matched, this one is a
    # catchall that will encrypt the file using KMS set C as well as PGP
    # The absence of a path_regex means it will match everything
    - kms: 'arn:aws:kms:us-west-2:927034868273:key/fe86dd69-4132-404c-ab86-4269956b4500,arn:aws:kms:us-west-2:142069644989:key/846cfb17-373d-49b9-8baf-f36b04512e47,arn:aws:kms:us-west-2:361527076523:key/5052f06a-5d3f-489e-b86c-57201e06f31e'
      pgp: 'FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4'
```

--------------------------------

### Provision Azure Key Vault and Permissions

Source: https://getsops.io/docs/usage/identities/azure-kms

CLI commands to create a resource group, vault, key, and assign service principal permissions.

```bash
# Create a resource group if you do not have one:
$ az group create --name sops-rg --location westeurope
# Key Vault names are globally unique, so generate one:
$ keyvault_name=sops-$(uuidgen | tr -d - | head -c 16)
# Create a Vault, a key, and give the service principal access:
$ az keyvault create --name $keyvault_name --resource-group sops-rg --location westeurope
$ az keyvault key create --name sops-key --vault-name $keyvault_name --protection software --ops encrypt decrypt
$ az keyvault set-policy --name $keyvault_name --resource-group sops-rg --spn $AZURE_CLIENT_ID \
    --key-permissions get encrypt decrypt
# Read the key id:
$ az keyvault key show --name sops-key --vault-name $keyvault_name --query key.kid

https://sops.vault.azure.net/keys/sops-key/some-string
```

--------------------------------

### Configure Vault and Encrypt with SOPS

Source: https://getsops.io/docs/usage/identities/hashicorp-vault-openbao

Commands to set environment variables, enable the transit engine, create keys, and perform encryption using SOPS.

```bash
$ # Substitute this with the address Vault is running on
$ export VAULT_ADDR=http://127.0.0.1:8200 

$ # this may not be necessary in case you previously used `vault login` for production use
$ export VAULT_TOKEN=toor 

$ # to check if Vault started and is configured correctly
$ vault status
Key             Value
---		-----
Seal Type       shamir
Initialized     true
Sealed          false
Total Shares    1
Threshold       1
Version         1.2.0
Cluster Name    vault-cluster-618cc902
Cluster ID      e532e461-e8f0-1352-8a41-fc7c11096908
HA Enabled      false

$ # It is required to enable a transit engine if not already done (It is suggested to create a transit engine specifically for SOPS, in which it is possible to have multiple keys with various permission levels)
$ vault secrets enable -path=sops transit
Success! Enabled the transit secrets engine at: sops/

$ # Then create one or more keys
$ vault write sops/keys/firstkey type=rsa-4096
Success! Data written to: sops/keys/firstkey

$ vault write sops/keys/secondkey type=rsa-2048
Success! Data written to: sops/keys/secondkey

$ vault write sops/keys/thirdkey type=chacha20-poly1305
Success! Data written to: sops/keys/thirdkey

$ sops encrypt --hc-vault-transit $VAULT_ADDR/v1/sops/keys/firstkey vault_example.yml

$ cat <<EOF > .sops.yaml
creation_rules:
    - path_regex: \.dev\.yaml$
      hc_vault_transit_uri: "$VAULT_ADDR/v1/sops/keys/secondkey"
    - path_regex: \.prod\.yaml$
      hc_vault_transit_uri: "$VAULT_ADDR/v1/sops/keys/thirdkey"
EOF

$ sops encrypt --verbose prod/raw.yaml > prod/encrypted.yaml
```

--------------------------------

### Create GCP KMS Keyring and Key

Source: https://getsops.io/docs/usage/identities/google-cloud-kms

Commands to provision a new KMS keyring and encryption key via the gcloud SDK.

```bash
$ gcloud kms keyrings create sops --location global
$ gcloud kms keys create sops-key --location global --keyring sops --purpose encryption
$ gcloud kms keys list --location global --keyring sops

# you should see
NAME                                                                   PURPOSE          PRIMARY_STATE
projects/my-project/locations/global/keyRings/sops/cryptoKeys/sops-key ENCRYPT_DECRYPT  ENABLED
```

--------------------------------

### Authenticate with GCP using Application Default Credentials

Source: https://getsops.io/docs/usage/identities/google-cloud-kms

Commands to log in and enable Application Default Credentials for GCP authorization.

```bash
$ gcloud auth login
```

```bash
$ gcloud auth application-default login
```

--------------------------------

### Configure HuaweiCloud KMS in .sops.yaml

Source: https://getsops.io/docs/usage/identities/huaweicloud-kms

Define creation rules in the .sops.yaml configuration file to specify KMS keys for path-based encryption.

```yaml
creation_rules:
    - path_regex: \.hckms\.yaml$
      hckms:
        - tr-west-1:abc12345-6789-0123-4567-890123456789,tr-west-2:def67890-1234-5678-9012-345678901234
```

--------------------------------

### Encrypting a file with multiple PGP public keys

Source: https://getsops.io/docs/security

Use this command to initialize or edit a SOPS file using a comma-separated list of PGP public keys instead of KMS.

```bash
$ sops edit --pgp "E60892BB9BD89A69F759A1A0A3D652173B763E8F,84050F1D61AF7C230A12217687DF65059EF093D3,85D77543B3D624B63CEA9E6DBC17301B491B3F21" mynewfile.yaml
```

--------------------------------

### Define SOPS creation rules in .sops.yaml

Source: https://getsops.io/docs/usage/identities/config-file

Specify encryption keys based on file path patterns using regex. Rules are evaluated in order, and the first matching rule is applied.

```yaml
creation_rules:
    # upon creation of a file under development,
    # KMS set A is used
    - path_regex: .*/development/.*
      kms: 'arn:aws:kms:us-west-2:927034868273:key/fe86dd69-4132-404c-ab86-4269956b4500,arn:aws:kms:us-west-2:361527076523:key/5052f06a-5d3f-489e-b86c-57201e06f31e+arn:aws:iam::361527076523:role/hiera-sops-prod'
      pgp: 'FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4'

    # prod files use KMS set B in the PROD IAM
    - path_regex: .*/production/.*
      kms: 'arn:aws:kms:us-west-2:361527076523:key/5052f06a-5d3f-489e-b86c-57201e06f31e+arn:aws:iam::361527076523:role/hiera-sops-prod,arn:aws:kms:eu-central-1:361527076523:key/cb1fab90-8d17-42a1-a9d8-334968904f94+arn:aws:iam::361527076523:role/hiera-sops-prod'
      pgp: 'FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4'

    # other files use KMS set C
    - kms: 'arn:aws:kms:us-west-2:927034868273:key/fe86dd69-4132-404c-ab86-4269956b4500,arn:aws:kms:us-west-2:142069644989:key/846cfb17-373d-49b9-8baf-f36b04512e47,arn:aws:kms:us-west-2:361527076523:key/5052f06a-5d3f-489e-b86c-57201e06f31e'
      pgp: 'FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4'
```

--------------------------------

### Configure PGP Fingerprints

Source: https://getsops.io/docs/usage/first-steps

Set the SOPS_PGP_FP environment variable with comma-separated PGP public key fingerprints.

```bash
export SOPS_PGP_FP="85D77543B3D624B63CEA9E6DBC17301B491B3F21,E60892BB9BD89A69F759A1A0A3D652173B763E8F"
```

--------------------------------

### Encrypt and decrypt existing files

Source: https://getsops.io/docs/usage/common-operations

Encrypts a cleartext file using environment variables for keys and decrypts an encrypted file.

```bash
$ export SOPS_KMS_ARN="arn:aws:kms:us-west-2:927034868273:key/fe86dd69-4132-404c-ab86-4269956b4500"
$ export SOPS_PGP_FP="C9CAB0AF1165060DB58D6D6B2653B624D620786D"
$ sops encrypt /path/to/existing/file.yaml > /path/to/new/encrypted/file.yaml
```

```bash
$ sops decrypt /path/to/new/encrypted/file.yaml
```

--------------------------------

### Define destination rules in .sops.yaml

Source: https://getsops.io/docs/usage/publishing

Configure destination buckets and paths for publishing, including optional re-encryption rules for specific providers.

```yaml
destination_rules:
    - s3_bucket: "sops-secrets"
      path_regex: s3/*
      recreation_rule:
          pgp: F69E4901EDBAD2D1753F8C67A64535C4163FB307
    - gcs_bucket: "sops-secrets"
      path_regex: gcs/*
      recreation_rule:
          pgp: F69E4901EDBAD2D1753F8C67A64535C4163FB307
    - vault_path: "sops/"
      vault_kv_mount_name: "secret/" # default
      vault_kv_version: 2 # default
      path_regex: vault/*
      omit_extensions: true
```

--------------------------------

### Configure PGP keys in .sops.yaml

Source: https://getsops.io/docs/usage/key-management

Use the Block Scalar YAML construct to define a list of PGP fingerprints for creation rules.

```yaml
creation_rules:
    - pgp: >-
        85D77543B3D624B63CEA9E6DBC17301B491B3F21,
        FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4
```

--------------------------------

### Configure Service Principal Environment Variables

Source: https://getsops.io/docs/usage/identities/azure-kms

Required environment variables for authenticating via Service Principal.

```bash
AZURE_TENANT_ID
AZURE_CLIENT_ID
AZURE_CLIENT_SECRET
```

--------------------------------

### Configure custom GPG executable

Source: https://getsops.io/docs/usage/identities/pgp

Set the SOPS_GPG_EXEC environment variable to point to a custom GPG client wrapper.

```bash
SOPS_GPG_EXEC = 'your_gpg_client_wrapper'
```

--------------------------------

### Update keys using the command line

Source: https://getsops.io/docs/usage/key-management

Apply changes defined in .sops.yaml to an existing encrypted file.

```bash
$ sops updatekeys test.enc.yaml
```

--------------------------------

### Encrypting and Decrypting Binary Files

Source: https://getsops.io/docs/usage/common-operations

Demonstrates in-place encryption and decryption of binary files using SOPS. Note that the resulting file will be stored as JSON with base64-encoded data.

```bash
$ dd if=/dev/urandom of=/tmp/somerandom bs=1024
count=512
512+0 records in
512+0 records out
524288 bytes (524 kB) copied, 0.0466158 s, 11.2 MB/s

$ sha512sum /tmp/somerandom
9589bb20280e9d381f7a192000498c994e921b3cdb11d2ef5a986578dc2239a340b25ef30691bac72bdb14028270828dad7e8bd31e274af9828c40d216e60cbe /tmp/somerandom

$ sops encrypt -i /tmp/somerandom
please wait while a data encryption key is being generated and stored securely

$ sops decrypt -i /tmp/somerandom

$ sha512sum /tmp/somerandom
9589bb20280e9d381f7a192000498c994e921b3cdb11d2ef5a986578dc2239a340b25ef30691bac72bdb14028270828dad7e8bd31e274af9828c40d216e60cbe /tmp/somerandom
```

--------------------------------

### Create Service Principal via Azure CLI

Source: https://getsops.io/docs/usage/identities/azure-kms

Command to generate a new Service Principal for Key Vault access.

```bash
$ az ad sp create-for-rbac -n my-keyvault-sp

{
    "appId": "<some-uuid>",
    "displayName": "my-keyvault-sp",
    "name": "http://my-keyvault-sp",
    "password": "<random-string>",
    "tenant": "<tenant-uuid>"
}
```

--------------------------------

### Encrypting from stdin with creation rules

Source: https://getsops.io/docs/usage/advanced

Encrypting data while specifying a filename to trigger matching creation rules in .sops.yaml.

```bash
$ echo 'foo: bar' | sops encrypt --filename-override path/filename.sops.yaml > encrypted-data
```

--------------------------------

### Authenticate with GCP using OAuth Tokens

Source: https://getsops.io/docs/usage/identities/google-cloud-kms

Methods to authorize using an OAuth 2.0 access token.

```bash
$ export GOOGLE_OAUTH_ACCESS_TOKEN=<your access token>
```

```bash
$ export GOOGLE_OAUTH_ACCESS_TOKEN="$(gcloud auth print-access-token)"
```

--------------------------------

### Configure SOPS GCP KMS Client Type

Source: https://getsops.io/docs/usage/identities/google-cloud-kms

Set the environment variable to toggle between gRPC and REST clients.

```bash
$ export SOPS_GCP_KMS_CLIENT_TYPE=rest  # Use REST client
$ export SOPS_GCP_KMS_CLIENT_TYPE=grpc  # Use gRPC client (default)
```

--------------------------------

### Set a document sub-part from file or stdin

Source: https://getsops.io/docs/usage/common-operations

Provide the value to be set via a file path or standard input stream.

```bash
# Provide the value from a file
$ echo '{"uid1":null,"uid2":1000,"uid3":["bob"]}' > /tmp/example-value
$ sops set --value-file ~/git/svc/sops/example.yaml '["an_array"][1]' /tmp/example-value

# Provide the value from stdin
$ echo '{"uid1":null,"uid2":1000,"uid3":["bob"]}' | sops set --value-stdin ~/git/svc/sops/example.yaml '["an_array"][1]'
```

--------------------------------

### Set AWS Credentials via Environment Variables

Source: https://getsops.io/docs/usage/first-steps

Alternative method to provide AWS credentials using environment variables.

```bash
export AWS_ACCESS_KEY_ID="AKI......"
export AWS_SECRET_ACCESS_KEY="mw......"
```

--------------------------------

### Configure key groups in .sops.yaml

Source: https://getsops.io/docs/usage/identities/key-groups

Defines multiple key groups within the creation rules of a SOPS configuration file.

```yaml
creation_rules:
    - path_regex: .*keygroups.*
      key_groups:
          # First key group
          - pgp:
                - fingerprint1
                - fingerprint2
            kms:
                - arn: arn1
                  role: role1
                  context:
                      foo: bar
                - arn: arn2
                  aws_profile: myprofile
          # Second key group
          - pgp:
                - fingerprint3
                - fingerprint4
            kms:
                - arn: arn3
                - arn: arn4
          # Third key group
          - pgp:
                - fingerprint5
```

--------------------------------

### Add a key group via CLI

Source: https://getsops.io/docs/usage/identities/key-groups

Adds a new key group containing specified PGP and KMS keys to a target file.

```bash
$ sops groups add --file my_file.yaml --pgp fingerprint1 --pgp fingerprint2 --pgp fingerprint3 --kms arn1 --kms arn2 --kms arn3
```

--------------------------------

### Configure AWS KMS ARNs

Source: https://getsops.io/docs/usage/first-steps

Set the SOPS_KMS_ARN environment variable with comma-separated master key ARNs.

```bash
export SOPS_KMS_ARN="arn:aws:kms:us-east-1:656532927350:key/920aff2e-c5f1-4040-943a-047fa387b27e,arn:aws:kms:ap-southeast-1:656532927350:key/9006a8aa-0fa6-4c14-930e-a2dfb916de1d"
```

--------------------------------

### Standard Edit Command

Source: https://getsops.io/docs/usage/first-steps

The primary command for managing encrypted files.

```bash
$ sops edit <file>
```

--------------------------------

### Set Encryption Context via CLI

Source: https://getsops.io/docs/usage/identities/amazon-aws-kms

Apply an encryption context when editing a file using the --encryption-context flag.

```bash

$ sops edit --encryption-context Environment:production,Role:web-server test.dev.yaml

```

--------------------------------

### Unsupported Top-level YAML Array

Source: https://getsops.io/docs/reference

Top-level arrays are not supported because SOPS requires a root key for metadata.

```yaml
---
  - some
  - array
  - elements
```

--------------------------------

### Supported YAML Array Structure

Source: https://getsops.io/docs/reference

Wrap arrays in a root key to allow SOPS to inject metadata.

```yaml
data:
    - some
    - array
    - elements
```

--------------------------------

### Encrypting with custom input types

Source: https://getsops.io/docs/usage/advanced

Encrypting data from stdin while specifying the input format type.

```bash
$ echo foo=bar | sops encrypt --filename-override path/filename.sops.yaml --input-type dotenv > encrypted-data
```

--------------------------------

### Encrypting a file with age

Source: https://getsops.io/docs/usage/identities/age

Use the --age flag to specify one or more age recipients for encryption.

```bash
$ sops encrypt --age age1yt3tfqlfrwdwx0z0ynwplcr6qxcxfaqycuprpmy89nr83ltx74tqdpszlw test.yaml > test.enc.yaml
```

--------------------------------

### Unsupported Top-level JSON Array

Source: https://getsops.io/docs/reference

Top-level JSON arrays are not supported.

```json
[
  "some",
  "array",
  "elements"
]
```

--------------------------------

### Encrypt and Decrypt JSON Files

Source: https://getsops.io/docs/reference

Standard workflow for encrypting and decrypting files while maintaining the original extension.

```bash
$ sops encrypt -i myfile.json
$ sops decrypt myfile.json
```

--------------------------------

### Encrypt and Decrypt Files with SOPS

Source: https://getsops.io/docs/usage/identities/google-cloud-kms

Basic commands to encrypt a file using a specific KMS ResourceID and decrypt the resulting file.

```bash
$ sops encrypt --gcp-kms projects/my-project/locations/global/keyRings/sops/cryptoKeys/sops-key test.yaml > test.enc.yaml
```

```bash
$ sops decrypt test.enc.yaml
```

--------------------------------

### Decrypting with format control

Source: https://getsops.io/docs/usage/advanced

Specifying input and output formats or overriding filenames to ensure correct parsing.

```bash
$ cat encrypted-data | sops decrypt --filename-override filename.yaml > decrypted-data
$ cat encrypted-data | sops decrypt --input-type yaml --output-type yaml > decrypted-data
```

--------------------------------

### Encrypt and Decrypt Files with SOPS

Source: https://getsops.io/docs/usage/identities/azure-kms

Commands to encrypt files using specific or latest key versions and decrypt them.

```bash
$ sops encrypt --azure-kv https://sops.vault.azure.net/keys/sops-key/some-string test.yaml > test.enc.yaml
```

```bash
$ sops encrypt --azure-kv https://sops.vault.azure.net/keys/sops-key/ test.yaml > test.enc.yaml
```

```bash
$ sops decrypt test.enc.yaml
```

--------------------------------

### Configure JSON Indentation

Source: https://getsops.io/docs/reference

Set custom indentation for JSON and JSON_binary stores in .sops.yaml.

```yaml
stores:
    json:
        indent: 2
    json_binary:
        indent: 2
```

--------------------------------

### Decrypt with Input Type Flag

Source: https://getsops.io/docs/reference

Use the --input-type flag when the file extension does not match the original format.

```bash
$ sops encrypt myfile.json > myfile.json.enc

$ sops decrypt --input-type json myfile.json.enc
```

--------------------------------

### Configure Shamir threshold in .sops.yaml

Source: https://getsops.io/docs/usage/identities/key-groups

Sets a persistent Shamir threshold for a specific creation rule in the configuration file.

```yaml
creation_rules:
    - path_regex: .*keygroups.*
      shamir_threshold: 2
      key_groups:
          # First key group
          - pgp:
                - fingerprint1
                - fingerprint2
            kms:
                - arn: arn1
                  role: role1
                  context:
                      foo: bar
                - arn: arn2
                  aws_profile: myprofile
          # Second key group
          - pgp:
                - fingerprint3
                - fingerprint4
            kms:
                - arn: arn3
                - arn: arn4
          # Third key group
          - pgp:
                - fingerprint5
```

--------------------------------

### Set a document sub-part

Source: https://getsops.io/docs/usage/common-operations

Use the set command to update specific keys or array elements in a YAML or JSON file using Python-style path syntax.

```bash
$ sops set ~/git/svc/sops/example.yaml '["app2"]["key"]' '"app2keystringvalue"'
```

```bash
$ sops set ~/git/svc/sops/example.yaml '["an_array"][1]' '"secretuser2"'
```

```bash
$ sops set ~/git/svc/sops/example.yaml '["an_array"][1]' '{"uid1":null,"uid2":1000,"uid3":["bob"]}'
```

--------------------------------

### Dropping privileges during execution

Source: https://getsops.io/docs/usage/advanced

Use the --user flag to execute the child process with reduced privileges, which is useful when the encrypted file requires root access but the target program does not.

```bash
# the encrypted file can't be read by the current user
$ cat out.json
cat: out.json: Permission denied

# execute sops as root, decrypt secrets, then drop privileges
$ sudo sops exec-env --user nobody out.json 'sh'
sh-3.2$ echo $database_password
jf48t9wfw094gf4nhdf023r

# dropped privileges, still can't load the original file
sh-3.2$ id
uid=4294967294(nobody) gid=4294967294(nobody) groups=4294967294(nobody)
sh-3.2$ cat out.json
cat: out.json: Permission denied
```

--------------------------------

### Configure YAML Indentation

Source: https://getsops.io/docs/reference

Set custom indentation for YAML stores in .sops.yaml.

```yaml
stores:
    yaml:
        indent: 2
```

--------------------------------

### Decrypt with local and remote key services

Source: https://getsops.io/docs/usage/advanced

Decrypts a file using both the default local key service and a specified remote unix socket.

```bash
$ sops decrypt --keyservice unix:///tmp/sops.sock file.yaml
```

--------------------------------

### Decrypt File to Standard Output

Source: https://getsops.io/docs/usage/first-steps

Use the decrypt flag to output the cleartext content of an encrypted file.

```bash
$ sops decrypt mynewtestfile.yaml
```

--------------------------------

### Encrypt specific keys using regex

Source: https://getsops.io/docs/usage/common-operations

Use the --encrypted-regex flag to target specific keys for encryption while leaving others in cleartext.

```bash
$ sops encrypt --encrypted-regex '^(data|stringData)$' k8s-secrets.yaml
```

--------------------------------

### Configure SOPS Audit Logging

Source: https://getsops.io/docs/usage/advanced

Defines the PostgreSQL connection string for audit logs in the mandatory configuration file.

```yaml
backends:
    postgres:
        - connection_string: "postgres://sops:sops@localhost/sops?sslmode=verify-full"
```

```yaml
backends:
    postgres:
        - connection_string: "postgres://sops:sops@localhost/sops?sslmode=verify-full"
        - connection_string: "postgres://sops:sops@remotehost/sops?sslmode=verify-full"
```

--------------------------------

### KMS ARN and Role Combination

Source: https://getsops.io/docs/usage/identities/amazon-aws-kms

Format for specifying a role directly in the command line flags using a plus sign separator.

```text
<KMS ARN>+<ROLE ARN>
arn:aws:kms:us-west-2:927034868273:key/fe86dd69-4132-404c-ab86-4269956b4500+arn:aws:iam::927034868273:role/sops-dev-xyz

```

--------------------------------

### Configure gitattributes for SOPS diffs

Source: https://getsops.io/docs/usage/common-operations

Add this to a .gitattributes file at the repository root to associate YAML files with the sopsdiffer filter.

```text
*.yaml diff=sopsdiffer
```
Tokens:
Raw