A TypeScript implementation of credstash for storing and retrieving secrets using AWS KMS and DynamoDB.
A TypeScript implementation of the python credstash for storing and retrieving secrets using AWS KMS and DynamoDB.
This code is based on the now defunct node-credstash library, but has been updated to TypeScript with up-to-date dependencies.
Before using credstasher, you need to:
1. Set up AWS credentials (AWS CLI, environment variables, or IAM roles)
2. Create a KMS key or use an existing one
3. Optionally create a DynamoDB table (the library _can_ create it for you, but it's better if you set up before)
You can install globally using the node package manager of your choice:
``bash
npm install -g node-credstasher
pnpm add -g node-credstasher
bun add -g node-credstasher
`
After it is installed, you should be able to run the following to show the docs:
`bash`
credstasher --help
Yuu can also run using npx, pnpx, etc. downloading it to run on the fly. This is kind of nice.
`bash
npx node-credstasher@latest --help
pnpx node-credstasher@latest --help
bunx node-credstasher@latest --help
`
#### Setup the DynamoDB table
⚠️ I don't recommend using this. Set up your table in a more managed way, probably. But, you _can_ do it this way if you like.
`bash`
credstasher setup
#### Store a secret
`bash`
credstasher put my-password "supersecret123"
`bash`
credstasher get my-password
`bash`
credstasher list
`bash`
credstasher delete mypassword
Global options:
- -r, --region Command-specific options: - Install with your favorite package manager: pnpm add node-credstasher bun add node-credstasher const client = new CredstashClient({ // Store a secret // Retrieve a secret // List all secrets // Delete a secret The - - See LOCAL_TESTING.md. - Uses AWS KMS for key encryption/decryption MIT This project was created using : AWS region (default: us-east-1)-t, --table
- : DynamoDB table name (default: credential-store)-k, --kms-key-id
- : KMS key ID or alias (default: alias/credstash)-p, --profile
- : AWS profile (default: default)-d, --dynamodb-endpoint
- : Custom endpoint URL for DynamoDB-e, --kms-endpoint
- : Custom KMS endpoint URLput:-v, --key-version
- : Specific version number-c, --context
- : Encryption context as JSON string-a, --autoversion
- : Automatically increment versionget
- :-v, --key-version
- : Specific version number-c, --context
- : Encryption context as JSON string-n, --noline
- : Don't append newline to outputdelete
- :-v, --key-version
- : Specific version number-a, --all
- : Delete all versions`Library Usage
$3
bash`
npm install node-credstasheror
or
$3
typescript`
import { CredstashClient } from 'node-credstasher';
region: 'us-east-1',
table: 'my-secrets',
kmsKeyId: 'alias/my-key'
});
await client.putSecret('database-password', 'my-secret-password');
const password = await client.getSecret('database-password');
const secrets = await client.listSecrets();
await client.deleteSecret('database-password');$3
accepts the following configuration options:region: AWS region (defaults to AWS_REGION env var or 'us-east-1')kmsRegion
- : AWS region for KMS, defaults to region value.table
- : DynamoDB table name (defaults to CREDSTASH_TABLE env var or 'credential-store')kmsKeyId
- : KMS key ID or alias (defaults to CREDSTASH_KMS_KEY_ID env var or 'alias/credstash')profile
- : AWS profile (defaults to AWS_PROFILE env var or 'default')dynamodbEndpoint
- : Custom endpoint URL for dynamodbkmsEndpoint
- : Custom endpoint URL for KMSAWS_REGION$3
: Default AWS regionKMS_REGION
- : Default AWS region for KMSCREDSTASH_TABLE
- : Default DynamoDB table nameCREDSTASH_KMS_KEY_ID
- : Default KMS key IDAWS_PROFILE
- : Default AWS profileDYNAMODB_ENDPOINT
- : Custom endpoint URL for dynamodbKMS_ENDPOINT
- : Custom endpoint URL for KMS`Development
$3
bash`
bun run build$3
bash`
bun run format
bun run lint$3
bash`
bun run check$3
Security Features
- Stores encrypted data in DynamoDB
- Supports encryption context for additional security
- Uses AES-256-GCM for symmetric encryption
- Includes HMAC verification for data integrity
- Supports versioning of secretsLicense