plugin does not decrypt an AWS KMS encrypted file

[edkreepio]

I am having some issues to make it work as well, i got a sops encrypted file called aws_credentials (no extension). I am using AWS KMS

The content of aws_credentials looks like this:

{
	"data": "ENC[AES256_GCM,data:DATA_IN_BASE64_HERE,type:str]",
	"sops": {
		"kms": [
			{
				"arn": "arn:aws:kms:eu-central-1:MY_AWS_ACCOUNT_ID:key/MY_KEY_ID",
				"created_at": "2023-10-09T14:18:03Z",
				"enc": "ANOTHER_BASE64_ENC",
				"aws_profile": ""
			}
		],
		"gcp_kms": null,
		"azure_kv": null,
		"hc_vault": null,
		"age": null,
		"lastmodified": "2023-10-09T14:18:26Z",
		"mac": "ENC[AES256_GCM,data:BASE_64_MAC,type:str]",
		"pgp": null,
		"unencrypted_suffix": "_unencrypted",
		"version": "3.7.3"
	}
}

Running sops -d aws_credentials decrypts the file successfully!

$ sops --version                                              
sops 3.7.3

JetBrains Rider 2023.3.3
Build #RD-233.14015.60, built on January 19, 2024
Licensed to me
Subscription is active until October 25, 2024.
Runtime version: 17.0.9+7-b1087.11 amd64
VM: OpenJDK 64-Bit Server VM by JetBrains s.r.o.
Linux 6.5.0-25-generic
.NET Core v7.0.10 x64 (Server GC)
GC: G1 Young Generation, G1 Old Generation
Memory: 2956M
Cores: 12
Registry:
editor.config.csharp.support=true
Non-Bundled Plugins:
com.github.daputzy.intellij-sops-plugin (1.5.1)
com.intellij.ml.llm (233.14015.147)
Current Desktop: ubuntu:GNOME

[DaPutzy]

It checks if there is a sops config in any parent folder in the project.

Is that the case in your project? Thats about the only thing i can think of why it wouldnt work.

[edkreepio]

So far I have only tried this particular combination, perhaps you could give an working example to start with?

BTW is the file extension relevant? I renamed the file to aws_credentials.json and unfortunately didn't work.

The plugin settings are set to its default, and sops executable is in the PATH.

[edkreepio]

Side note, the content of the un-encrypted aws_credentials file it is NOT json NEITHER yaml.

For instance:

[default]
aws_access_key_id = SOME_KEY
aws_secret_access_key = SOME_REGION
region = eu-central-1

[DaPutzy]

Your settings look good and the file ending should not matter (at least for decrypting). But the plugin requires a sops config (.sops.yaml) in the same or any of the parent folders.

I would link to the relevant section of the official sops README but it appears github has issues rendering it :D

[DaPutzy]

Any update? :)

[DaPutzy]

Hi, did the sops config fix your issue?

[DaPutzy]

Ill close this for now, within the next couple of days a new release will hit that should be able to sops without a .sops.yaml (#22).

I would appreciate it if you could remove/adjust your rating in the jetbrains marketplace once your issue is resolved.