Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for sharing encrypted EBS resources cross account #70

Merged
merged 3 commits into from May 8, 2020

Conversation

giovannt0
Copy link
Collaborator

@giovannt0 giovannt0 commented May 8, 2020

Few changes:

  • Added encrypted attribute to AWSVolume class.
  • When calling CreateVolumeCopy() with a destination account that is not the same as the source account, we now check if the target volume is encrypted. If so, a one-time use KMS shared key (between source and destination account) is generated. Subsequently, the initial target volume is duplicated + encrypted with the temporary shared key. We then use this temporary volume for the remainder of the code (i.e., getting a new snapshot out of that temporary volume, sharing it with the destination account, and creating a copy within the destination account).

After execution, temporary volumes, snapshots and keys are deleted. The copy of the volume that sits in the destination account is encrypted with the default EBS/KMS key particular to that account.

Closes #63

Signed-off-by: Theo Giovanna gtheo@google.com

libcloudforensics/aws.py Outdated Show resolved Hide resolved
libcloudforensics/aws.py Outdated Show resolved Hide resolved
@codecov-io
Copy link

codecov-io commented May 8, 2020

Codecov Report

Merging #70 into master will decrease coverage by 3.16%.
The diff coverage is 63.63%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master      #70      +/-   ##
==========================================
- Coverage   65.20%   62.03%   -3.17%     
==========================================
  Files           2        2              
  Lines         661      706      +45     
==========================================
+ Hits          431      438       +7     
- Misses        230      268      +38     
Flag Coverage Δ
#nosetests 62.03% <63.63%> (-3.17%) ⬇️
Impacted Files Coverage Δ
libcloudforensics/aws.py 67.94% <63.39%> (-9.43%) ⬇️
libcloudforensics/gcp.py 57.99% <65.00%> (-0.14%) ⬇️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update c60fba0...eb225f8. Read the comment docs.

libcloudforensics/aws.py Show resolved Hide resolved
Signed-off-by: Theo Giovanna <gtheo@google.com>
Signed-off-by: Theo Giovanna <gtheo@google.com>
Signed-off-by: Theo Giovanna <gtheo@google.com>
@giovannt0 giovannt0 merged commit 3c2e40d into google:master May 8, 2020
@giovannt0 giovannt0 deleted the aws-otp-encryption branch May 8, 2020 18:26
@giovannt0 giovannt0 mentioned this pull request Jun 4, 2020
6 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Deal with EBS volume encryption in AWS
3 participants