KMS for AWS Secrets encryption

Kubernetes gives us the option to specify certain encryption providers when storing the Secrets on etcd. AWS KMS can be used as an encryption provider to encrypt the Secrets hosted on etcd.

Provisioning KMS

We shall provision a KMS key using Terraform:

resource "aws_kms_key" "ksm_kms_key" {
  description             = "ksm_kms_key"
  deletion_window_in_days = 30
  enable_key_rotation     = true
}

That key is now ready to be used standalone or with other AWS components.

Using KMS with EKS

Having created the EKS cluster, we can now specify the credentials that will decrypt the Secrets:

module "ksm_eks" {
    ...
  create_kms_key = false
  cluster_encryption_config = {
    resources = ["secrets"]
  ...