Release JavaScript AWS KMS Storage v1.0.0

.github/workflows/publish.npm.storage.aws.kms.yml

@@ -0,0 +1,115 @@
+name: Publish AWS Storage to NPM
+on:
+  workflow_dispatch:
+    inputs:
+      publish:
+        description: 'Publish to NPM (uncheck to build only)'
+        required: false
+        default: true
+        type: boolean
+
+jobs:
+  generate-sbom:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Get the source code
+        uses: actions/checkout@v3
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v3
+        with:
+          node-version: '20'
+
+      - name: Install package dependencies
+        run: npm install
+        working-directory: ./sdk/javascript/packages/aws
+
+      - name: Install Syft
+        run: |
+          echo "Installing Syft v1.18.1..."
+          curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /tmp/bin v1.18.1
+          echo "/tmp/bin" >> $GITHUB_PATH
+
+      - name: Install Manifest CLI
+        run: |
+          echo "Installing Manifest CLI v0.18.3..."
+          curl -sSfL https://raw.githubusercontent.com/manifest-cyber/cli/main/install.sh | sh -s -- -b /tmp/bin v0.18.3
+
+      - name: Create Syft configuration
+        run: |
+          cat > syft-config.yaml << 'EOF'
+          package:
+            search:
+              scope: all-layers
+            cataloger:
+              enabled: true
+              java:
+                enabled: false
+              python:
+                enabled: false
+              nodejs:
+                enabled: true
+          EOF
+
+      - name: Generate and upload SBOM
+        env:
+          MANIFEST_API_KEY: ${{ secrets.MANIFEST_TOKEN }}
+        run: |
+          JAVASCRIPT_SDK_DIR="./sdk/javascript"
+
+          # Get version from package.json
+          echo "Detecting AWS Storage version..."
+          if [ -f "${JAVASCRIPT_SDK_DIR}/packages/aws/package.json" ]; then
+            VERSION=$(grep -o '"version": "[^"]*"' "${JAVASCRIPT_SDK_DIR}/packages/aws/package.json" | cut -d'"' -f4)
+            echo "Detected version: ${VERSION}"
+          else
+            VERSION="1.0.0"
+            echo "Could not detect version, using default: ${VERSION}"
+          fi
+
+          echo "Generating SBOM with Manifest CLI..."
+          /tmp/bin/manifest sbom "${JAVASCRIPT_SDK_DIR}/packages/aws" \
+            --generator=syft \
+            --name=keeper-secrets-manager-javascript-storage-aws-kms \
+            --version=${VERSION} \
+            --output=spdx-json \
+            --file=aws-storage-sbom.json \
+            --api-key=${MANIFEST_API_KEY} \
+            --publish=true \
+            --asset-label=application,sbom-generated,nodejs,aws-storage \
+            --generator-config=syft-config.yaml
+
+          echo "SBOM generated and uploaded successfully: aws-storage-sbom.json"
+          echo "---------- SBOM Preview (first 20 lines) ----------"
+          head -n 20 aws-storage-sbom.json
+
+  publish-npm:
+    needs: generate-sbom
+    if: ${{ github.event.inputs.publish == 'true' }}
+    environment: prod
+    runs-on: ubuntu-latest
+
+    defaults:
+      run:
+        working-directory: ./sdk/javascript/packages/aws
+
+    steps:
+      - name: Get the source code
+        uses: actions/checkout@v3
+
+      - name: Retrieve secrets from KSM
+        id: ksmsecrets
+        uses: Keeper-Security/ksm-action@master
+        with:
+          keeper-secret-config: ${{ secrets.KSM_KSM_CONFIG }}
+          secrets: |
+            NScQiZwrHJFCPv1gL8TX6Q/field/password > env:NPM_TOKEN
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Build package
+        run: npm run build
+
+      - name: Publish package
+        run: npm publish

.github/workflows/test.javascript.storage.aws.kms.yml

@@ -0,0 +1,38 @@
+name: Test JavaScript Storage - AWS KMS
+
+on:
+  push:
+    branches:
+      - 'release/storage/javascript/aws-kms/**'
+    paths:
+      - 'sdk/javascript/packages/aws/**'
+      - '.github/workflows/test.javascript.storage.aws.kms.yml'
+  pull_request:
+    branches:
+      - 'release/storage/javascript/aws-kms/**'
+    paths:
+      - 'sdk/javascript/packages/aws/**'
+  workflow_dispatch:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ./sdk/javascript/packages/aws
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js 20.x
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20.x'
+          cache: 'npm'
+          cache-dependency-path: sdk/javascript/packages/aws/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run tests
+        run: npm test

sdk/javascript/packages/aws/.eslintrc

@@ -0,0 +1,26 @@
+{
+    "root": true,
+    "parser": "@typescript-eslint/parser",
+    "parserOptions": {
+        "project": "./tsconfig.json",
+        "sourceType": "module",
+        "ecmaVersion": "latest"
+    },
+    "plugins": [
+        "@typescript-eslint",
+        "prettier",
+        "jest"
+    ],
+    "extends": [
+        "eslint:recommended",
+        "plugin:@typescript-eslint/recommended",
+        "plugin:jest/recommended",
+        "plugin:jest/style",
+        "plugin:prettier/recommended"
+    ],
+    "rules": {
+        "prettier/prettier": "error",
+        "no-console": "error"
+    },
+    "ignorePatterns": ["node_modules/", "dist/", "coverage/"]
+}

sdk/javascript/packages/aws/.gitignore

@@ -0,0 +1 @@
+yarn.lock

sdk/javascript/packages/aws/README.md

@@ -0,0 +1,120 @@
+# AWS KSM
+Keeper Secrets Manager integrates with AWS KMS in order to provide protection for Keeper Secrets Manager configuration files.  With this integration, you can protect connection details on your machine while taking advantage of Keeper's zero-knowledge encryption of all your secret credentials.
+
+## Features
+* Encrypt and Decrypt your Keeper Secrets Manager configuration files with AWS KMS.
+* Protect against unauthorized access to your Secrets Manager connections.
+* Requires only minor changes to code for immediate protection. Works with all Keeper Secrets Manager Javascript SDK functionality.
+
+## Prerequisites
+* Supports the JavaScript Secrets Manager SDK.
+* Requires `@aws-sdk/client-kms` package.
+* Key needs `Encrypt` and `Decrypt` permissions.
+
+## Setup
+
+1. Install KSM Storage Module
+
+The Secrets Manager AWS KSM module can be installed using npm.
+
+> `npm install @keeper-security/secrets-manager-aws`
+
+2. Configure AWS Connection
+
+By default the @aws-sdk library will utilize the default connection session setup with the AWS CLI with the aws configure command. If you would like to specify the connection details, the two configuration files located at `~/.aws/config` and `~/.aws/credentials` can be manually edited.
+
+See the AWS documentation for more information on setting up an AWS session [here](https://docs.aws.amazon.com/cli/latest/reference/configure/)
+
+Alternatively, configuration variables can be provided explicitly as an access key using the AwsSessionConfig data class and providing  `awsAccessKeyId` , `awsSecretAccessKey` and  `region` variables.
+
+You will need an AWS Access Key to use the AWS KMS integration.
+
+For more information on AWS Access Keys see the [AWS documentation](https://aws.amazon.com/premiumsupport/knowledge-center/create-access-key/)
+
+3. Add AWS KMS Storage to Your Code
+
+Now that the AWS connection has been configured, you need to tell the Secrets Manager SDK to utilize the KMS as storage.
+
+To do this, use `AWSKeyValueStorage` as your Secrets Manager storage in the `SecretsManager` constructor.
+
+The storage will require an AWS Key ID, as well as the name of the Secrets Manager configuration file which will be encrypted by AWS KMS.
+```
+    import {AWSKeyValueStorage,AWSSessionConfig,LoggerLogLevelOptions} from "@keeper-security/secrets-manager-aws";
+
+    const getKeeperRecordsAWS = async () => {
+
+        const accessKeyId ="<YOUR AWS ACCESS KEY>>";
+        const secretAccessKey = "<YOUR AWS SECRET_ACCESS_KEY>";
+        const regionName = "<YOUR AWS REGION>";
+
+        const awsSessionConfig = new AWSSessionConfig(accessKeyId, secretAccessKey, regionName);
+
+        // oneTimeToken is used only once to initialize the storage
+        // after the first run, subsequent calls will use ksm-config.txt
+        const oneTimeToken = <one time token>;
+        const logLevel = LoggerLogLevelOptions.Debug;
+        const keyId = 'arn:aws:kms:ap-south-1:<accountName>:key/<keyId>';
+        const storage = await new AWSKeyValueStorage(keyId,config_path,awsSessionConfig,logLevel).init();
+
+        await initializeStorage(storage, oneTimeToken);
+
+        // Using token only to generate a config (for later usage)
+        // requires at least one access operation to bind the token
+
+        const {records} = await getSecrets({storage: storage});
+        console.log(records);
+
+        const firstRecord = records[0];
+        const firstRecordPassword = firstRecord.data.fields.find((x: { type: string; }) => x.type === 'bankAccount');
+        console.log(firstRecordPassword.value[0]);
+    }
+    console.log("start");
+    getKeeperRecordsAWS();
+```
+
+## Change Key operation and using default credentials from AWS
+```
+    import {AWSKeyValueStorage,AWSSessionConfig} from "@keeper-security/secrets-manager-aws";
+
+    const getKeeperRecordsAWS = async () => {
+
+        const awsSessionConfig2 = new AWSSessionConfig();
+        let config_path = "<path to client-config-aws.json>";        
+        const oneTimeToken = "US:kYKVGFJ2605-9UBF4VXd14AztMPXcxZ56zC9gr7O-Cw";
+        const keyId = 'arn:aws:kms:ap-south-1:<accountName>:key/<keyId>';
+        const keyId2 = "arn:aws:kms:<cloud-region>:<accountNumber>:key/<keyId2>"
+        const storage = await new AWSKeyValueStorage(keyId,config_path).init();
+        await storage.changeKey(keyId2);
+        await initializeStorage(storage, oneTimeToken);
+
+        const {records} = await getSecrets({storage: storage});
+        console.log(records);
+
+        const firstRecord = records[0];
+        const firstRecordPassword = firstRecord.data.fields.find((x: { type: string; }) => x.type === 'bankAccount');
+        console.log(firstRecordPassword.value[0]);
+    }
+    console.log("start");
+    getKeeperRecordsAWS();
+```
+
+## Decrypt config operation
+we can decrypt config and save locally the decrypted file original config
+```
+    const storage = await new AWSKeyValueStorage(keyId,config_path).init();
+    await storage.decryptConfig();    
+```
+
+## Logging
+We support logging for the AWS KSM integration. Supported log levels are as follows
+* trace
+* debug
+* info
+* warn
+* error
+* fatal
+All these levels should be accessed from the LoggerLogLevelOptions enum. If no log level is set, the default log level is info. We can set the logging level to debug to get more information about the integration.
+
+You're ready to use the KSM integration Using the AWS KMS Integration 👍
+
+Once setup, the Secrets Manager AWS KMS integration supports all Secrets Manager JavaScript SDK functionality.  Your code will need to be able to access the AWS KMS APIs in order to manage the decryption of the configuration file when run. 

sdk/javascript/packages/aws/eslint.config.mjs

@@ -0,0 +1,11 @@
+import globals from "globals";
+import pluginJs from "@eslint/js";
+import tseslint from "typescript-eslint";
+
+/** @type {import('eslint').Linter.Config[]} */
+export default [
+  { files: ["src/*.ts}"] },
+  { languageOptions: { globals: globals.browser } },
+  pluginJs.configs.recommended,
+  ...tseslint.configs.recommended,
+];

sdk/javascript/packages/aws/jest.config.js

@@ -0,0 +1,9 @@
+module.exports = {
+    "roots": [
+        "<rootDir>/test"
+    ],
+    "transform": {
+        "^.+\\.(ts|tsx)$": "ts-jest"
+    },
+    "testEnvironment": "node"
+}