Serverless Plugin 1password

homepage icon https://github.com/kandsten/serverless-plugin-1password
Follow @kandsten

Tracked

NPM Downloads Last Month
15
Issues
0
Stars
0
Forks
0
Watchers
0
Watch Star Fork Issue Download License NPM Build Status Coverage Status Contributors

Repo README Contents:

serverless-plugin-1password

License: ISC

Description

This plugin for the Serverless framework provides access to secrets stored in 1Password. Behind the scenes, it uses the 1Password CLI to communicate with 1Password.

Prerequisites

The 1Password Command Line Tool must be installed and functional. The plugin has been tested with v1.8.0, but slightly older versions are also likely to work.

Installation

Run npm install in your Serverless project:

$ npm install --save-dev serverless-plugin-1password

Add the plugin to your serverless.yml file:

plugins:
  - serverless-plugin-1password

Usage

Access 1Password items via Serverless variables:

custom:
  IdpCredentials: ${1password:'Microsoft IDP credentials'}

…which can then be accessed elsewhere in your serverless config:

Type: AWS::Cognito::UserPoolIdentityProvider
Properties:
  UserPoolId: !Ref CognitoUserPoolUsers
  ProviderName: Microsoft
  ProviderType: OIDC
  ProviderDetails:
    client_id: ${self:custom.IdpCredentials.username}
    client_secret: ${self:custom.IdpCredentials.password}
  [...]

The default fields returned are username and password. For other fields, see the fields argument, below.

Arguments

Supply arguments to the plugin by prepending them to the item. Anything after the last (non-quoted) colon will be considered to be the requested item; anything prior to it is considered to be arguments.

${1password:'argument1:argument2=value:test item'}

Available arguments

A note on quoting - Serverless variables are parsed in a fairly complex manner. If any part of your 1password invocation - field names or item names - contains either spaces or commas, you must quote the string.

To retain sanity, quote the entire string.

These will break:

  ${1password:Test item}
  ${1password:Item, test}
  ${1password:vault=Top secret:TestItem}
  ${1password:vault=Secrets,Top:TestItem}

These will work:

  ${1password:'Test item'}
  ${1password:'Item, test'}
  ${1password:'vault=Top secret:TestItem'}
  ${1password:'vault=Secrets,Top:TestItem'}

Additionally, you must quote colons in your item names or arguments. This will return fields from an item named Test: the item

  ${1password:'Test\: the item'}

Authors and acknowledgment

Contributing

Feel free to raise issues and/or send in pull requests.

The general idea is to keep this plugin lightweight; will consider features if they support current or future 1Password and/or Serverless features.

Please do not introduce third party runtime dependencies.

License

Internet Systems Consortium license

Copyright (c) 2021, Kriss Andsten

Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.

THE SOFTWARE IS PROVIDED “AS IS” AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

Implementation notes

Security considerations

Given that the plugin is intended to handle secrets, some care was taken:

1Password gotchas