Ephemera - One Time Secret Distribution
All secrets submitted here are deleted after 24hrs, and for obvious reasons security reasons do not use this as an hosted secret transfer solution!
npm install serverless -g npm install serverless-s3-sync --save serverless deploy
IMPORTANT: You will need to tweak
config.yml to make bucket names etc. unique.
Ephemera is a one-time secret transfer tool intended to help you in the transition from legacy tools which do not allow secure secret communication (e.g. via password reset URLs or key fingerprints).
It is not intended to be a replacement for proper user-centric secret management, but merely a transitional phase to help eradicate secrets attached to plaintext emails.
This project is currently functional but needs work to add unit tests etc.
How it Works
Ephemera uses five components
- AWS S3 for website hosting
- AWS Lambda for GUID creation and secret management
- AWS DynamoDB for secret storage
- AWS KMS for secret encryption
The user is presented with a website that gives them the option to upload a text secret.
Uploading a Secret
When uploading a text secret, the user submits the secret via a text box, the contents of which are submitted to the API Gateway
addTextSecret method. This method generates a GUID and saves the secret in the private S3 bucket as with that GUID as its key. The method then returns the GUID combined with the specified websiteURL for the address of the secret return page which the user can then give to the person they wish to transmit the secret to.
Retrieving a Secret
getSecret method submitting that GUID for retrieval. The return of this method includes the secret which is displayed for the user.
use_https_ui setting in
config.yml. This will additionally create an AWS CloudFront distribution to front the S3 Website and update the S3 Bucket Policy accordingly.
NOTE: You will need to request or import an SSL Certificate in ACM in the
us-east-1 Region (See https://docs.aws.amazon.com/acm/latest/userguide/acm-regions.html) before enabling the HTTPS feature, and add the resultant ACM Certificate
Identifier to the
Please feel free to submit pull requests of any type, whether they're bugfixes, test improvements, new features, anything!
Just make sure that if it necessitates a new AWS resource you represent it in the Terraform templates and that it does not require per hour services (e.g. EC2 or ECS).
Author:: Sam Martin (email@example.com)