1Password Vault named “Dev” with a Login called “AWS Key”, where username is your AWSACCESSKEYID and password is your AWSSECRETACCESSKEY (configurable; change below) The Script. Put this script anywhere, /bin/enter-aws-session would be a good place. Note that in order for environment variables to be properly propagated, you have. When I started using 1Password in 2017, I did not know that 1Password.EU existed so I have been using 1Password.com since then. Now I would like to switch to 1Password.eu. I just created an account there and I would like to import my 400+ items. 50 of these items have 2FA-codes and linked documents.
Tl;dr:Copy & Paste the script and source it into your shell. But since this is about handling your secrets, you should know what is it doing and why.
Passwords secure your digital identity and everybody knows to keep them save. As its usage skyrocketed, more sophisticated users use password manager as the trade-off seems to favor completely unique passwords over the possible compromitation of the manager1.
Yet the computers that belong to the sophisticated users—developers—are often littered with passwords stored in clear text. Both SSH private key as well as AWS API key is a password in disguise and I’ve been always bothered that the default is to just dump it into ~/.aws/credentials.
In a company setting, this can be solved in various ways, but all are fairly complicated for individual developers. I gravitated towards 1Password as my personal password manager and decided to use it for storing the AWS credentials as well.
Since I am using the subscription service2, I have decided to use a dedicated vault for my keys and put it into an online vault, also because it makes my cross-platform scripting easier. If you still favor locally stored vaults for privacy reasons, the scripts below will not work for you.
Requirements
- 1Password CLI installed and you signed in once (run
op signin https://my.1password.com/ youremail@example.comand see the linked page for details) - Locally-installed jq package (because I am lazy)
- AWS account with generated
AWS_ACCESS_KEY_IDandAWS_SECRET_ACCESS_KEY - 1Password Vault named “Dev” with a Login called “AWS Key”, where username is your
AWS_ACCESS_KEY_IDand password is yourAWS_SECRET_ACCESS_KEY(configurable; change below)
The Script
Put this script anywhere, ~/bin/enter-aws-session would be a good place. Note that in order for environment variables to be properly propagated, you have to source the script, not just run it:
Here’s the non-magic. Configure the item name and the region.
How it works
The op (presumably One Password) connects to 1Password service via HTTPS API3. API returns the first item that matches configured ITEM_NAME4. The username and password retrieved from that item are then exported as the appropriate variables to the environment.
Note that as mentioned earlier, in order for those variables to be exported in the parent terminal process, you mustsource the script instead of just running it.
The Modifications
Definitely change your Valt Name, Item Name and Region based on your preferences. If you are using any other 1Password than the shared one on my subdomain, you probably need to change the OP_SESSION variable check.
Above can be easily altered to accept command line arguments, but I actually prefer to have multiple scripts per each of my “roles” and just change the values in the header.
You may want to store the key pair in secure note or some other container. In that case, look at the $VAULT_CONTENT variable to alter the query properly.
Again, the script uses ITEM_NAME as a unique key and random things will happen if you put in multiple logins under the same name. That resulting computer fire is on you.
The Alternatives and The Disclaimers
Alternative ways to handling the secrets include:
Your OS’s “default” secret chain:
- Keychain on MAC OS X
- DPAPI on Windows
- One of the zilion kinda-working alternatives on Linux: libsecret, Gnome.Keyring, KWallet, …
Command-line password manager (like pass on Unix)
Full-blown secret handling solution like Vault
Giving up, crying and relying on operating system privileges (encrypting hard drive and having secrets in clear text files)
Your secrets are of course still easily discoverable in your env vars, but this at least isolates you better from other programs.
It should also be noted that I am an unemployed writer, not a security engineer. If you are using this at work, this may violate your security policies and send your credentials to RussianChinese American hackers.
Use at your own risk under UPL.
Changelog
1password Eu Vs Com
- Script simplified at the suggestion of 1Password’s VPE and text updated accordingly on May 12, 2020
1password Autofill
Although they do have surprising architectural vulnerabilities as outlined in this 2019 ISE report: https://www.ise.io/casestudies/password-manager-hacking/↩︎
Apparently a future for 1password with one-time fee licensing being deprecated and buried. Although I don’t like it, I understand why they do it from business perspective. ↩︎
In order to do that, you need working connection to your vault; here I assume my.1password.com. I consider this reasonable assumption given you are going to connect to AWS and cloud, but you may need to adjust your proxy or VPN settings accordingly. ↩︎
Uniqueness could be guaranteed using
uuidattribute instead of the name, but in that case, one would have to manually inspect for it using the CLI or parse it from the URL you are able to export. Having a dedicated vault with sensible and unique names sounds like a better option for personal usage. ↩︎
- Password manager 1Password partnered with Privacy.com to offer users unique virtual credit cards that can be used to pay for online goods and subscriptions.
- 1Password will automatically suggest virtual credit cards for all the services you’ve saved in the app, and let you set up payment rules.
- The virtual credit cards will only work with the corresponding online app or service and will be useless to hackers in case of a data breach.
If you’re still using the same sets of passwords to manage tens to hundreds of online accounts, then you’re doing passwords wrong. What you need is a password manager that offers and remembers for you complex, unique passwords that aren’t easy to guess. The only password you’ll need to remember is the password that unlocks that password manager. That’s exactly what 1Password is, although there are plenty of alternatives that do the same job.
1password Eu Vat
These apps prevent hackers from getting into your Netflix account or any other service you have an account with, and 1Password has just announced an awesome new feature that will take user security to a whole new level. The app will now let you save unique virtual credit cards for each online service or app that you have an account with. That way, hackers will have a harder time stealing the details of your actual cards in case one of those services is compromised.
1Password is hardly the only company that offers access to virtual credit or debit cards. But the password manager now integrates that functionality for customers in the US.
To use the same Netflix example, 1Password will now let you assign a unique virtual credit card to Netflix, which can be saved inside the app for quick reference. That’s the only card you’ll need to pay for your subscription, and the virtual card will only work on that service. You can even set spending rules, including the max amount charged to the card and the frequency of payments.
The virtual credit card will still link up to your debit card, credit card, or checking account that you use for online payments. But if hackers breach Netflix and somehow steal payment information, your credit card data will be useless.
1Password partnered with Privacy.com for the service, so you’ll need to be a customer of Privacy.com before taking advantage of the feature. The service only works in America for the time being, but it might be expanded to other markets in the near future. That’s not up to 1Password, however, as the feature needs that Privacy.com functionality to work.
1Password is also running two different promos. You can save 25% for the first year of 1Password (1Password Business, 1Password Teams, and 1Password Families), and three months of Privacy Pro if you’re already a 1Password customer. Once you have both services active, you’ll be able to take advantage of the new virtual credit card feature.
The following video shows the feature in action, and this support page will help you get started: