Veramo AWS KMS Plugin

The Veramo AWS KMS Plugin is a plugin for the Veramo framework that allows you to use AWS Key Management Service (KMS) for signing data.

Installation

To install the Veramo AWS KMS Plugin, run the following command:

npm install @spherity/veramo-kms-aws

Pre-requisites

To use the Veramo AWS KMS Plugin, you need to ensure that the AWS IAM user or role associated with your Veramo application has the necessary permissions. Here are the required AWS policies that you need to add:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VeramoKMSPluginPermissions",
            "Effect": "Allow",
            "Action": [
                "kms:TagResource",
                "kms:PutKeyPolicy",
                "kms:CreateKey",
                "iam:CreateServiceLinkedRole",
                "kms:GetPublicKey",
                "kms:ScheduleKeyDeletion",
                "kms:Sign"
            ],
            "Resource": "*"
        }
    ]
}

Make sure to replace the Resource field with the appropriate ARN if you want to restrict the permissions to specific KMS keys.

This will grant the necessary permissions to your Veramo application to interact with the AWS KMS service.

Remember to adjust the IAM policies according to your specific requirements and security considerations.

Usage

To use the Veramo AWS KMS Plugin for signing data, you need to configure it with your AWS credentials and the ID of the KMS key you want to use. Here's an example of how to configure the plugin:

import { createAgent } from '@veramo/core';
import { AwsKeyManagementSystem } from '@spherity/veramo-kms-aws';

const agent = createAgent({
    plugins: [
        new AwsKeyManagementSystem({
            accessKeyId: 'YOUR_AWS_ACCESS_KEY_ID',
            secretAccessKey: 'YOUR_AWS_SECRET_ACCESS_KEY',
            region: 'YOUR_AWS_REGION',
        }),
    ],
});

Once the plugin is configured, you can use the sign method to sign data using the AWS KMS key. Only a single string value for the algorithm is supported, which can be either ES256K, ES256K-R, or eth_rawSign:

const signature = await agent.keyManagerSign.sign({
    data: 'Hello, World!',
    algorithm: 'ES256K',
});

Additionally, the Veramo AWS KMS Plugin provides functionality to create and delete keys in the AWS Key Management Service. This allows you to manage your encryption keys directly from your Veramo application.

To create a new key, you can use the createKey method provided by the plugin:

await agent.keyManagerCreate.createKey({
    alias: 'my-new-key',
});

To delete a key, you can use the deleteKey method:

await agent.keyManagerDelete.deleteKey({
    alias: 'my-key-to-delete',
});

These methods provide a convenient way to manage your keys within your Veramo application.

Contributing

Contributions are welcome! If you have any ideas, suggestions, or bug reports, please open an issue or submit a pull request on the GitHub repository.

License

This project is licensed under the MIT License.