Efficient Management of Secrets with SOPS (with examples)

SOPS, or Secrets OPerationS, is a versatile command-line tool designed to securely manage secrets by encrypting and decrypting files. Created by Mozilla, SOPS supports a variety of encryption methods and seamlessly integrates with cloud-based key management services, making it a reliable choice for developers and system administrators who need to handle sensitive data. Below, we explore several use cases for the SOPS command, offering insights into its functionality and practical applications.

Use case 1: Encrypt a file

Code:

sops -e path/to/file.json > path/to/file.enc.json

Motivation: Encrypting files that contain sensitive information, such as API keys or configuration settings, is crucial for maintaining data security. This is especially important when files are stored in version control systems, like Git, where unauthorized users might gain access.

Explanation:

• -e: This flag tells SOPS to encrypt the specified file.
• path/to/file.json: The path to the input file that contains sensitive information which needs to be encrypted.
• >: Redirects the encrypted output to a new file.
• path/to/file.enc.json: The path to the output file where the encrypted data will be stored.

Example output: The command will not produce direct terminal output but will create a new encrypted file at the specified path.

Use case 2: Decrypt a file to stdout

Code:

sops -d path/to/file.enc.json

Motivation: In scenarios where quick access to sensitive data is necessary without saving a decrypted version to disk, decrypting to stdout allows for fast retrieval while minimizing security risks.

Explanation:

• -d: This flag informs SOPS that it should decrypt the specified file.
• path/to/file.enc.json: The encrypted file that needs to be decrypted for viewing.

Example output: The decrypted content of file.json is displayed in the terminal, allowing for temporary access.

Use case 3: Update the declared keys in a sops file

Code:

sops updatekeys path/to/file.enc.yaml

Motivation: Updating keys, such as encryption policies or metadata within a SOPS file, ensures that the file adheres to the most current access and security standards. This is necessary as organizational policies evolve or when compliance requirements change.

Explanation:

• updatekeys: This command updates the encryption keys declared in the SOPS file.
• path/to/file.enc.yaml: The path to the SOPS file whose keys need updating.

Example output: The specified file’s encryption keys are refreshed, but no terminal output is shown.

Use case 4: Rotate data keys for a sops file

Code:

sops -r path/to/file.enc.yaml

Motivation: Rotating data keys increases security by changing the keys that encrypt the data, decreasing the risk of key compromise over time. Regular key rotation is a best practice in secure data management.

Explanation:

• -r: Command to rotate data keys in the specified SOPS file.
• path/to/file.enc.yaml: The path to the SOPS file where key rotation is to be performed.

Example output: Keys within the file are rotated, updating its encryption, with changes saved to the file system silently.

Use case 5: Change the extension of the file once encrypted

Code:

sops -d --input-type json path/to/file.enc.json

Motivation: Specifying input type allows for flexibility in working with various file formats by ensuring the decrypted output remains consistent with the original data structure, even if the filename does not suggest its content type.

Explanation:

• -d: Decrypt the file indicated.
• --input-type json: Explicitly state the input file type as JSON for correct parsing.
• path/to/file.enc.json: The encrypted JSON file.

Example output: Displays the decrypted content maintaining JSON format irrespective of the file extension.

Use case 6: Extract keys by naming them, and array elements by numbering them

Code:

sops -d --extract '["an_array"][1]' path/to/file.enc.json

Motivation: Extracting specific data from a file is useful when only a subset of the encrypted data is needed for a specific operation or review, saving time and reducing data exposure.

Explanation:

• -d: Decrypt command.
• --extract '["an_array"][1]': Specifies the path to the desired data within the file, extracting the second element of an_array.
• path/to/file.enc.json: Path to the encrypted JSON file from which the data should be extracted.

Example output: The command returns the second element within an_array in the decrypted format.

Use case 7: Show the difference between two sops files

Code:

diff <(sops -d path/to/secret1.enc.yaml) <(sops -d path/to/secret2.enc.yaml)

Motivation: Comparing two encrypted files is essential in auditing changes or resolving conflicts in configuration files to ensure system accuracy and integrity.

Explanation:

• diff: A UNIX utility used to compare files line by line.
• <(sops -d ...): Process substitution is used here to pass the decrypted output of each file into diff without creating temporary files on the disk.

Example output: Displays differences line by line between secret1.enc.yaml and secret2.enc.yaml.

Conclusion:

SOPS offers a robust set of features for encrypting, decrypting, and managing secrets in files, ensuring sensitive information remains secure throughout its lifecycle. With these practical examples, users can confidently employ SOPS in various contexts to enhance their data security practices.