15-Secrets.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<center> \n",
    "    <h3><b> Adnan Rashid </b></h3>\n",
    "    <nav>\n",
    "    | <a href=\"00-Contents-Setup.ipynb\"> Home Page </a> | \n",
    "    <a href=\"http://bit.ly/cka_notes_original\"> Kubernetes Notes </a> |\n",
    "    <a href=\"https://adnan.study\"> Website </a> |\n",
    "    <a href=\"https://www.instagram.com/adnans_techie_studies/\"> Instagram </a> |\n",
    "    <a href=\"https://www.linkedin.com/in/adnanrashid1/\"> LinkedIn </a> |\n",
    "    </nav>\n",
    "\n",
    "</center>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<center><h1 style=\"background:black\"><code style=\"background:black;color:white\">Encrypting Kubernetes Secrets</code></h1></center>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<div class=\"alert alert-block alert-warning\">\n",
    "<font style=\"color:black\">\n",
    "<center>We will look at storing secrets in EKS which leverages KMS</center>\n",
    "</font>\n",
    "</div>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<center><img src=\"https://adnanstudyimages.s3-eu-west-1.amazonaws.com/29.jpg\" width=\"40%\" height=\"40%\" border=5/></center>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<blockquote>Kubernetes can store secrets that pods can access via a mounted volume. \n",
    "\n",
    "Today, Kubernetes secrets are stored with Base64 encoding, but security teams would prefer a stronger approach. \n",
    "\n",
    "EKS clusters version 1.13 and higher support the capability of encrypting your kubernetes secrets using Key Management Service (KMS) and Customer Managed Keys (CMK). \n",
    "\n",
    "No changes in the way you are using secrets are required. \n",
    "\n",
    "The only requirement is to enable the encryption provider support during EKS cluster creation. "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<center><img src=\"https://www.eksworkshop.com/images/eks-secrets-flow-small-1-1024x621.png\"/></center>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Workflow "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "1. The user (typically in an admin role) creates a secret. \n",
    "\n",
    "2. The Kubernetes API server in the EKS control plane generates a Data Encryption Key (DEK) locally and uses it to encrypt the plaintext payload in the secret. Note that the control plane generates a unique DEK for every single write, and the plaintext DEK is never saved to disk. \n",
    "\n",
    "3. The Kubernetes API server calls <b> kms:Encrypt </b> to encrypt the DEK with the CMK. This key is the root of the key hierarchy, and, in the case of KMS, it creates the CMK on a hardware security module (HSM). In this step, the API server uses the CMK to encrypt the DEK and also catches the base64 of the encrypted DEK. \n",
    "\n",
    "4. The API server stores the DEK-encrypted secret in etcd. \n",
    "\n",
    "5. If one now wants to use the secret in, say a pod via a volume (read-path), the reverse process takes place. That is, the API server reads the encrypted secret from etcd and decrypts the secret with the DEK. \n",
    "\n",
    "6. The application, running in a pod on either EC2 or Fargate, can then consume the secret as usual. "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## <br><br>AWS KMS and Customer Key Store "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Considerations for your AWS KMS CMK "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "First lets take some time to understand options for generating your AWS KMS CMK. AWS KMS provides you with two alternatives to store your CMK. Your security requirements may dictate which alternative is suitable for your workloads on Amazon EKS. "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "This talk does a deep dive on this topic "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "image/jpeg": "/9j/4AAQSkZJRgABAQAAAQABAAD/2wCEAAUDBAgICAgICAgPCAgGBwgIBwcHBwoICAgICAgICAgICAgIFhALCAgOCQgIDhUNDhESExMTCAsWGBgSGBASExIBBQUFCAcIDgkJDxoQDRASEhISEhISEhISFRISEhISEhISEhISEhISEhISEhISEhISEhISFRISEhISEhISEhISEv/AABEIAWgB4AMBIgACEQEDEQH/xAAcAAEAAwADAQEAAAAAAAAAAAAABQYHAQQIAwL/xAA/EAABBAECBAUDBAEDAQQLAAACAAEDBAUREgYTFSEHFFKR0QgiMSMyQVFhJDNxQhYXgaE0NVRiZHJ0k7LB8P/EABgBAQEBAQEAAAAAAAAAAAAAAAABAgME/8QAJREBAAICAwEAAQQDAQAAAAAAAAECERMDElEhMUFhcZEEobEi/9oADAMBAAIRAxEAPwDxkiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAikujy+ofcvhOjy+ofcvhb128c9tfUaikujy+ofcvhOjy+ofcvhNdvDbX1GopLo8vqH3L4To8vqH3L4TXbw219RqKS6PL6h9y+E6PL6h9y+E128NtfUaikujy+ofcvhOjy+ofcvhNdvDbX1GopLo8vqH3L4To8vqH3L4TXbw219RqKS6PL6h9y+E6PL6h9y+E128NtfUaikujy+ofcvhOjy+ofcvhNdvDbX1GopLo8vqH3L4To8vqH3L4TXbw219RqKS6PL6h9y+E6PL6h9y+E128NtfUaikujy+ofcvhOjy+ofcvhNdvDbX1GopLo8vqH3L4To8vqH3L4TXbw219RqKS6PL6h9y+E6PL6h9y+E128NtfUaikujy+ofcvhOjy+ofcvhNdvDbX1GopLo8vqH3L4To8vqH3L4TXbw219RqKS6PL6h9y+E6PL6h9y+E128NtfUaikujy+ofcvhOjy+ofcvhNdvDbX1GopLo8vqH3L4To8vqH3L4TXbw219RqKS6PL6h9y+E6PL6h9y+E128NtfUaikujy+ofcvhOjy+ofcvhNdvDbX1GopLo8vqH3L4To8vqH3L4TXbw219RqKS6PL6h9y+E6PL6h9y+E128NtfUaikujy+ofcvhOjy+ofcvhNdvDbX1GopLo8vqH3L4To8vqH3L4TXbw219RqKS6PL6h9y+E6PL6h9y+E128NtfUaikujy+ofcvhOjy+ofcvhNdvDbX1GopLo8vqH3L4To8vqH3L4TXbw219RqKS6PL6h9y+E6PL6h9y+E128NtfUaikujy+ofcvhOjy+ofcvhNdvDbX1GopLo8vqH3L4To8vqH3L4TXbw219TqIi9rwCIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIuCQHJkZ17Q8fczheFZcdBW4Io5NshWmkI/JQw8nkFEDC/Lhlc3JpNdX0/a/5Xnulwxd41zmSPDY6vidlYLZ4tpnhq1o68VWmccPKjbWaSVnPbyxbUz1fVtS515MtzxzE4Zoi2O59NPFUWOLIFBC7xwPPJjgtuWQEBBjIeWw8gpmbX7Gld326Nq/ZVLwn8LcvxOcrYyIOTV2+Yu25Xhqxkbbgj3ixGcrj920BfRtHLaztrqLQk0lSUWncSeBmeoZbGYedoCscQFOONsw2yKpI9aPmzjIbg0sLgDi/cH13Npu76SeQ+m/iWtXezY8tADZKvjxaW6bFIdq7Fj4LA7QcRrHPPHo5OxuJbtv4Z3eDpZjyK3ca+HOUxGYgwdsAe/dem1Vq8ryQz+emevXeOQhEtHmEgfUW0cC/jR3szeAWffLz4MSqneqYscpLsuyPD5Y5ngABPl73sObfscWbR2fd3bV3g6SytFs1j6ZuKwoPeevC5BFzixo3HLICDDuceWI8kp9Nf0xld+2jav2Vx8Gvp6iyvC9zIWogPJZSsc3DkzXrEccDFA7Qebij0Dd5lnd2IT0HRv7ZTZVY45zh5lOQR03Eza/jV2bX/jX8r9r0h4EYTiDB2OMMXBjqN+xjalRskdu5JGMbS1bM8I1yaMvNRlGROUZ8ttwt9yy7w58G85ncb1LFwx2IAuDR5Z2uXZeTbC5S7CbltAAzA5E5s/2noz9tUckE0n4oCLTvFXwMzvDdQL95oZqhSBHJNQsHM1eSR2aMZhlCMmEifaxiztroz6OQ693g76eeIspSr3o/LU4r476UeTulBPYB23BJHFEEjsJD9zbtHdnZ9NHZ3vePU6SyRcOrr4reGWT4Zlqw5N4XPIRyyweSsFOLDCUYnzHMQcC1lDTs7Pq/fstc+j7gfHW6OczVnHjmL2Id48bip+WUZSBUeyGgTax86aVxjGQ2dg5bu2mrpNsRlYpMzh5uEmf8Pr/wuVq3jJ4kUsvU8pNwtFgczRvRkc9eNoJGq8qZpK1mIwimAnI4yYSZ2+zXt2Z/vwd9O3EeSpwXWavQjvCJU4sncOCxYEhYgIYYwNwYhdnZj0L+XFmdlIv8zKTSYZEis+U4AzFbLtgZKJPlTlGOKpGQFz2NnKOWGV3aMoCASLmO7MLCe7btJmvHGn058R4nHWMnYetLDQgexbhq3TOxDCLbpJHGUAA2AWd3YSd3Zn0Yle0EUlkCLZcF9NPE9xqkkY1hgyNEbsdk7p8uIDGMoopmGNz55tIzswCQswHqTdmKG4B8Ds9mQszwjBUqUrMtU72RtPBXlnglOCYa7gJnIIyg473ER1fRnd2dmd4OkszRa5Q8A85HxBRw12GNhuM9rzIW3epao1pInvNXnEWNp2jkZthCLs5i/wCNCVo+p7wF6M55TDQBFhYIKUUtcrk9i692xbKtuijm3lIBPNVbTf8Awbs39zZC67PPaLZw+mfibyzTSPUisHC87YyXJON7YwuTjtEHheXRnbRpNrO37liu5iHVn7EOrP8Azo7fn/C1Fon8MzWY/IEgu7sxM7j+WZ2d2/50/C/a9A+PEOau4ngypaxtOoF8a8OLmpWzklmOavUhiGwJgLVI3GaMnESk7/z9veOo/S1xXJNYhIa0I1tjDZlvSciyRgx7a+yN5S26sxEYC2urM5aPpmLx+rc8c5+MPRS3GPDdzEXrGOyEXJt0jEZQYmMXYwGSOSOQexxHGQkz/wBF3ZnZ2ac8EOFetcQ4rHEO6Ge20tv7dw+Uqi9mwx/wwmEfL1f+Zhb+VrPzLHX7hTGdcr2B9THCOEyPDV7IYKlBBPwll5q916NOGuTjVkarfhk5TNvAGkjl/wAcjX/C86eHHhdl+IYL9jFxxzNiWieaCSd455imaR446wbXA5H5R/vIB/Grt3dsxeJjLU8cxOFKRbNxB9MvFlSCKYa0N0ppIozq0Lm+xCUpMDPJzxjjeMScWIxN2HV3f7RImjfErwC4gwFDqVwYZqsZRjZejZOaSq8hMAFMEgBrHzCEdwbtHJtdG+5rF4TpZlaLWeAPp94gzNGDIxPWp1Lo7qZ5C68Z2AfVhOOOAZHEXdu2/R3/ADpo7O8PkPBzO189V4cmijjyGSA5KcpWX8lPEENic5QsCLkwsNWYdrgxMQs23Qhd3ePTpbxnyLXuM/p04jxNC3krZVHq46A57Hl70skrRhprsA4wYi7/AI3MueB/py4lytOK8IQUYbYidUcnakhnmA21jkaKEJHjEm7sx6E7d9NHZ07wuuzIEV4y3hRm6mbq8P2YAhv5IxGnIc2tOcS3fqx2AZ3eNnA2f7dzO3cW1bW7Y76W+K5vM7grV/KyFHG892RmtuDNrJW5YE/Jd3dmKVgd3b8aaO7vCdJYiuHdd3OYuxRs2KduJ4LVKY4LEB6bo5Y30JtR1Eh/liF3YmdnZ3Z2dejvpXxuNDhTibL28PBlrGItWZYIrlSKY5ArYytYCsEkgmUYlIR/tZ+8jvo6WviMlaZnDzJqjOtQ8X/E6plcaVSHg+tgJuaMwX6sYhO7RAe6EdIYX2luHX7n/Ddu/bdvGnwUgy+W4UoYylHjqklG/NmrdGrHBsrRPjNm542Zjsk8kgR7tXZ5TLR2ElmeTEfWtUzPx451XDE2umvf+te69UW6/DHEXGmL4co46vDh8ENsrEtSAIZMtaq13fynmItDlqA4Nrq7vJyp3/G0n/PjTx5jcTbv4DIcC14sa0c0GLuxwxQyzfou0Fuq/LaN2Y3Z/wBORjDTv9zaKbP2XV8zl5bRcDro2r6vp3f+3XK6uQiIgIiICIiAiIgIiIC4Jcrh2Qe7/qW464qw8+MDh2gVyG1VnO4ceHs5Fo5IziaId1b/AGncTN9C/O1Zv9G1m9Pxhn7GTgKvfuY2SzcgmqnUMJZ7tSZ/9NMzHELiYkzP/BC/fXVZXH9Q/Ggswtni0FmZtcXi3fRm0bV3g1f/AJdQdDxa4jgylnNRZRxymRgCtbueTpFzYI2hGOPy5RvADM0EXcAF/t/L6lrwjjnGHonkrMxLc/oozVu3xHxM9q1JYezXeaXnzFJvlC6UYSaH2Z2AnFtOzNozaMzMzw6oz2PCzM1sOJSXuoWxsw0xd5zjG9XOeFgj+8yPGaNsZncmfRtdV554J48zGEsWLeKuvUsXgeOzM1atPzAeTmuzhaAwD7++osz/APh2X38P/ETM4GWWXFXiqvbcXsxcqKaCdwcnF5IZxId7ORaEOhNq7a6K245+4Z2Qv3gFgcvS4m4QLIVrFWnNeyLYyG80sQC4UJntPWqT6FAJOcDuTALHoPctvbpfVnn758X5eF7svKoS0oqkTTk0UAhTp2x2RM+zVrBlJq7a7tH/AIbSt53xa4iu5GllrGTI72IKQsdK1asMdR5g2TcqswcknMOzuYk76N37NpWOKc5bydyxkL83mbl0hOzYeOOJ5CCMIQflwMEY6Rxg32i37f71dIpMzmVnkjHx7r4aw9Xi4uDeMScRkxVW0VyJnZxeyUPKICf/AOGvxzEP4/c7rPPpe4p63x7xRlGfdHcoytW77m8pBcp1qjt/TFBDGX/JOqr4ecfUsF4dZCtFlglzOYkttXxkVkSs0BuGFJyaJvuh2xCdl3ftukbTu6hfop4pxuIzV+bJ3YqEE2HKKKW3MMMZSDbrHy2M9G37GJ2H8uwl/SxNMZdc/YaT9KeB4jq8V8Qz5eKxFAcE4Wpr7S8qzae5GdQ4Zj/TsMMA2NHjd2EZGbszsy6Hgux2+FPEqOixTvYv5zp0VdnkM45aRlWCvGGrluZ22iP5d9G1WQZ/xz4psVp8c+YMqUhSxbwggCzLWIiEYyuCLTOLxuzbmdjdvyT6uz1rw68RMzw9JLJiLj1WtMA2YnhinhmaPdy90U7EwkO8tCHQu7tro7stdJljbES3b6LKs8EXGsVqI4LEeNoc2G3EcU4OUGVMeZHMzGLuBCTat3Yhf8Oy6/g1kJ6vhPxHPWmKCaO/OITQm8cgNJHioz2GOhA7gZtq3fu6x2n4scQw2spdiybhZ4iGIctK1OmfmRhiKCEdksZDAIRGQNymB9NNXd2Z1FYvjjLVsVYwcFx48Tfk5tqj5euTSH+j93PMHnD/AGIewmzfZ/l9brmf9MbIj/beMDZObwey7TG8jV77hFvJzIIxydCVgFy10ZiMnb+lpnGvC9CePg65mq1+a/w7Rq2IW4ZxdrI0ZJ4xqSFFIdaOR4v1a8Tt9wOQ6tq7fjx/Q45ysWKmwQXCHD25mms48IK2sp8yKUnGyYPPGTlDG7aSM32/jR3Z/VPEvG2MyMeJLh7j6DhbH0KscB4mWrA0+wHDYPKtuziYxiwMLiQ9tWcmfvjkpMf26cd4n+nm76gOKzzXEV68dKTH7mggjp3YXhtxxwQiAFaiLuEx9y0/hiFtX01fteEVrizEhJnOH6081bn+TuNXrFerTHGASjFbpxayOIjMLjKzDteQmY2ciZ576ueP8Xn8zXlxX6sOPpPWlvvE8fmpHmkkYQY2YyhiYnYSLTV5pNG00cqX4eeJ+d4fYwxOQKtDPI0s1YoYbEEkjCw73CwJcs9oizkG13YR1/DLrWJmuHGZxf7L0p42FWz3A0PEHEOK6VkqdmvtGSI4rPKfIhVnjAZWGfy9iq5yNEbPpoBd9ok8z9UkmEiu4i3kuH7+X5MG7G3cJalCtVMJhlYdsBCIzu7QmxafcwDprs7eT/EXxJzfELx9WvlZjrk5wVhjigrRG47XMYa7CJybXJt57iZiJmdmfRTfB/jrxViqwU6mVd60AMEENqrXs8gBbQQjlmF5djNozCROzMzMzMuc8UusctXoHgDjqLO+IVOzPiZ8PLFwnahggy8PItzkVsZglCN9P0+Q9lhdtdWaX+GWA+J/CXEzZrimw9S4Ic7KWMjeZp4K02KaWQw5ll3GKzV8ty9sLEWohow/a7NVs3x3mLuRjy9rISSZOu8bwXgaOCSLkuTxtENdhjjFt5faw6Oxkz6s7qx8VeOHFOUpSY+7lXkq2I3isxxU6tcrMZNoQTSQgx7Xb8sDiz6uzs7LfSY/DM8lZhs31W5q3W4X4NhrWZK8dupCdga8xQvK9bHVShYyjdiIRKQi266btr/kW0m8w+Kl8OuGiyGJtZygFeiVqthpzCULbQSjPYtckhKSNrTzCW530kMXfv3by5xVx3l8rWo08jde1Ww8fKx8JV60Xlw5YQ7d9cAOX9OKNtZHJ/t/t3d5Hw78V+IOH4ygxeRKGschSFTlhis195N9xAE4k8Lu/d+W46v3fXVZ1zhdv3+mqeI/iJFkYeDcdVwV7EVcVn8a1S3mAIBnrwlFWKvDMWpWHYZI3J9z6MA6/ldr618blG4qpXatSaSGLHYtoLMdaWWm10Mnc5MRyCzxNK80kDMBOzu8oafubXF/ETxGzXEBxHlrz2fKb3rRjDDXjgeTbveMawg+59g/cTuX2t3UrxJ408UZGkFC3lSlrxywTM/la0c5SVZY56xHPGDSE4SxRlrrq7g25y7pHHME8sT8eh61HE+Ik0kWVwtzh/ijFUdr3uTNHHEwybWEZDYRmDmyu7RSgMm0pNhaM5Lx1egeI5YndieA5InIP2O8ZODuH/uvt7f40Wm5X6geL7VUqkuYdo5Y3jllhp1YLEgELiTc+EGKN3Z/3R7S/wArL9O2n8aaf+H4W+Osx+XPktFnrjxw/wDQ/Cv/AOrxP/4YhdH6l81cj8ReGYAtSBDXlwBxQhMQxidrMTQ2XYB7O8kQiBa/kW0ft2Xn/O+IubvR4yK1kHmDh04jxI+Vqx+UODlNETPCAvNtaCH/AHXPXZ311fX48Tcd5fJ5GDL3rr2MlSet5a29atE8Xk5ys1tIYAGEtkxEX3A+uuj6t2WI4p/66bY/40764R04uP8At8RQ1/53WW9+zeytn0SYytQrZ3inISNXq0IWoR2pAJ2iAWjtXZGZmdz/ADSFmFnd3Em/wvPnGvFmRzVt72VtPctvFHC85QwQfpROTgHLqjHH2cy77dX17u/ZdoOO8uOILADddsPJLzjoNXrsxyeYG1qdjZ5gm54iejyadmb8MzLfWeuGIvHbL1z9P1bhJmzOEx3EUmcfieOezdqXq7xu+8DgvTAXLjEylGxHuZ3f/aF2/DqqfSpjLOIp8f1DN47eG1haZvtNpatbJtHOP9asISN/gmdeYuFOIruJuQ5DHWHq3Ku/kzjHHJt5gFEbPHOxRmLgZNoQv+f4fR1YovFriMJcrMGTcZOJBjHLk1Gj/q2jr+VDUeXtgdoHcdYmB31d31L7lieKf0b3Rn62v6Y85dHgXjWw1uXn1AvWK07zGU0M5YgJCmjkJ3IZHkZi3a67m1/K+HhFakl8L+LxmlKVoLF1o+cbyODFUoTlo56u2spmf/zGT/l1g3DnHGWx1C9jKV14KGYEwyFVq9aRrAyQ8g2eWYCli1i+39Mh/v8APdc4njrLVMbcw9W68WMypGV+n5asbTlJHHEb86UCmj1CKNvsMf2/2767mn5/lmOX7H8Nsn8M8Hi+H8DkM7WyXEdnMxQ+Ro4meR69Bp4WtxwVgF2eNtpC3Yn3nvcRZuzWT6x+HLWXz/COMpC7WsjUvRROfd4maSrJLLK7d3GKIJTLTvpGWnd1iHCXjbxRiqI42llHjqQx8usB1a00lUNXfbBNMBEw99GEtzCzNt26My6Njxa4kkuY/IyZYzu4SCaDHWjq0yOCKxG0U4kzx7LLmDMzlMxlq2urP3WNc5a2VxhuP1HSTYfHYvhLGUbJYXGjWs8RZRqNg69iMZRllCxZAeUTO/MsTPrt1KMezCTL9fXRhMpcvYQ6NWe5RajK1UcdXmsBHdeViYhGuztHMUTw7C7O7Rlt/DrHM946cXX6tijczRTVL8Ele1B07GxtLBMDxyx74YRkDcBO2okztr2dk4P8c+KsVVClUyr+Vgj5deKzVr2Xrg34GKWYXk2s2jMJEQszMzMzdkiloLclfxD0z4uTMPEfhpBZJiykU0523Z2I2Z6taOVyJv8ApKxGen9vGWn4dUvifNXP+9+nD5qTkw2K9aOHnFyQgmwzzywjH+xgOUnN207kzP8Aw2nnWfjjMSZWPOS5A5MtBIMkN+UYpSjcGJgaOGQXgCNmM9I2DY28n01d1+7PHmXky4547rllwkCUL/l6zOxxweWB/LiHl+0LbdOXp/P57pHHKzywtP1VszcZ5/T/ANppv2/zi6Dv/wCbrY/pDyFupwZxXax8fOvVLluejCMRTvLZjxFQoY2hD7pXKRhba3d9dGXmHijPXMpcnyF+d7Ny6QFYsFHFE8hRxRwg/LrsEY6RxRj9ot+3X8u7qe4C8T8/gYZoMRknpQ2pufNG1SnYY5tgRczW5HIQvsAG0F2b7WWrUmaxDFbxF5lPeOvG/F2apRf9oMbJUrUJJDgmLCWsfHzponj2HNY+0ncWfQdWd+/50XsDjrxFhw2X4ax13a2P4noXKs0p6M0NqPp4VCMn/EB+YliJv7mjfVmF9fFHHPi3xHnKhUMtlHuUzkCQoHpUYGc49dhcypHHJ21ftu0UZx3x3ls75Zsvce62OiliqMVatByo5uVzR/0gR8zdyYu57nbZ201fWdJmIhuOWI/DQOPfB3OYHiZ6uAhmleGGTLYSeoTNYCpCYRygJE7c2eucwREDbikCSN9H5jit+8DuI8rxZRyWK4wwTjWrQRs965j5qIWCJzEmeKyzMFuNhaTmwuO12Z9Afbr5em8a+KyemT5uTfitfJyeWptIDPHyiGSRo91oCBm3DM5sTiJOzkLO3Y4v8deKsrVKlayrtXmjeOxHVrV6r2AJtCGWWEWk2OOrOIuIuxPqzspNLSkXrDO7oAMsoxHzIgmkCGTs/MiEyGOTUez7gYX1bt3XyXC5XeHnEREBERAREQEREBERAREQEREBERAXDrlEH52ptX6RAREQEREBnTVEQEREBERAREQEREEideu9MJWk0sDJtki3E5GxFLtdhdtBYQAfuYnb79HYX03RyaohkREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQERFZBERQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERWQREUBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREVkERFAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQERFZBERQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAXDuuVYvC6IZM9gozFjCXP4iM4zFiAwPI1hMCEuxC4u7aP/aEK4JM/4fX/AIfVcrbrQUc7eGjHC2Xs4hszdv2ypFgRakEtOGvRGHCx2LWQOGbmOxNFvfzGjPtYlJ3PBqnHPmIfJnyIWyT4649y/JPWOpg62TGKaCCu9YYhsWBDdcmgOQT0Ftw/djvH6umt5+RbR/3bY4p6ZVYStQ5058niq096aJ2wFXChdsFMVKOa1JZG/ZaBhjhKQ3xs4sP372lcl4a4OlZphYpTzDmOIeHsTHAOQnreRHNYqtbnL/URBYnKKeSTaMwRHpoxizs7JPJELqlgP/7R3/8A7/nsy1Xwghx1WXicclB5mjWx71JpHjYp4IZs7j8dJcg0/baijmKUdvd3j0/lWutj8aWHgr40gl6RW4yrzZaCENcpZg4Xo5CaZ3nFzar5i3JEDaM/KiB2cXfVJv8AWa0mYYAi9B0+A8VCUxQYKe7Db4bystGvanuQ5ae3Q6X5iOXH2YGerdZ7mgy1XkDRy2vrqzVoOAcZdtBgqUElfM3MBi8lSuXMhzIJrtinjr1qi1PYHLDy0t42JzMtYn/jRmmyFnjlkKKT4tGk1+4ONcnx8dqWOicp8w5K8ZbAmI20Z+Zt5mn8NIzfwoxdHOYEREBERAREVkERFAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBciTs7Oz6Ozs7Oz6Ozt3Z2du7OuFI8LYg8hep0I5AhPI24awTWC2wxlNIMbHIX52s7/hu79mb8oOjBKcZtIBkBi7u0gG4G2rOz6GP3Nqzuz9/wCV+hsysxC0hMJuLmLSFoTiHLHc34LSN3FtfwLuzdlacrwLO12WlRKS2VSIDuHkKXQHqnJO1eOOYcqYhG5yHEwbjZzeVhZtzOy+MHh9mCj5xUijiDmvLumreYCKveLG25moubWTCG2Bxm7BoJM2rsxMSnxrraFZikICEwNwOP8A2zEyEg7kX2E3cPuM37adzJ/5X6axJ2fmE7i7ELuZO4kLaCTP/BM2jM/8aMrLleAcnC2QlCsUtXE2chDLZJ4YJJAxkrxXJ46Rm88sUX28womkGNydnL7XdffG+HWQLMUsLdFsdZyJGzFKUVl4RAJjcpIaxuTP+iWgk4u7OztqLs7vi4lUN5fdoTtvbQtCdtzbmPQvU24RfR/5Fv6XIyEzaMTsz7tRYnZn3swn2b+xZmf+27K2XeBZTClPjLIZSpkorsgWmBsc1fprw+e8818hjqRxhZrlzDk2O0w99ey6tvgPMxSNDJjpBkeG5OwaxnrDj3225NwE46A7jo2up8yJxYubHumYTrKBK5M5hI85vJEDBHI8xucYMzswRm76gDMRaM2jNuf+1JcN8R2cfJNNXYHnnqyVgszxc6eqEsRQGdMyf9CbkmUbHo+0X7aflS0/h9fggvzXR8r06kVkAE4LjWJIslQxtmo8lWQmrWYZL4OYFqYuLC4tuZ24m8Nc6BjGWPdjNrDu3mqm2J6kQzWQtSMeynNHEYmUU7gYi+rs2j6WcSv1UWbTs34bsy5VoHw9zTyywNQfm1+Szi9mqIzFZgOzXjpSkbBkJZK8ZyCFZ5CIRd2ZRWbwFylHUltQPEGTrjap/qwyFNXkihmjmaOIiOMDjsROPMYd24mbVxJhuUmsoxFduJfDLIVLlWjDtvTXKctlyrkEUNeSnJNDk61iawQxxPUlgkGSQyEf2P23MnEnhlk6k1KCOPzb5KvAUZxPC0Y2zxsOTtU+aMhxu0FecS57kwGIuQ/h2adoTrKkorM3h/mnGqTY8y6jJBFWCM4ZJuZahexVGxBGTy0uZAJSi9gY2cAIvwLu3y/7EZP/AFO2CM+ngclkY8rjpDGKKGKxLMABK5WIAiniI5YmIA3PucXEtGYOsq8iuuX8LsxXvS0BhjsS1xqEZwZCo0O69tatDzJTFmtSSbwCB9JJHB3ASZ2d6TM+wnE/sIHcSA/tISF3YhIS7iTOzs7P+HZ1c5JhyisvDXC8NilNkb2RHG0YbkdAJfJzXp57skJWeTFWruLsAwDuKQiZm3Azbnft+Y+BsrJAFqGmU1WwYNXlY4QkmimteSr2fJmTWY6sllxjaYwYNxM25MnWVcRXan4V5k5ngkgjrE1TJWRKxkaTRv0qMTuVykjkIIrIFJEJBI47OaLntFnJuthPD7IWJarEDBBdn5DWK1infOKUqlm5DHLUrS82E5IakxC0uzVoydtdNHmYWKSqSKytwDmeVDL5AiG15HlBDPXnnfqY78e5VoTKeMJ2/YZgIu7O2rOzs36k8P8AMCNg3p6x0qwWrE4XqUlca8hWgCQLMcjwzM50rYaRkT74CB2YnYXqdZVhFbR4MEcGGbmuFHHYktRV4YcbPaiaSqYxvHdvRu0VCU3d3ACYtwsxdmdG8Nc65jG2OJ5CGUiFrVT9HkBBJPHbLmbaU4R2a5lFO4GwysTjpq7TML1lUkVsw3h9kp7UtWSAofKRRy2JI3gssDWcfZyNHl7JGCyM8FWQmKIy0ETJ/wBrsutDwLliCvI9PYNys9uN5blSLZUaLnebtNKYvRqPE7E01howJiHR33DqzCdZVxFPZzg3J0YjmuVfKhHKcLjParBMZxnHHIUFbfzrUAnLEzzRAcf3s+7TuoFUmMCIiIIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAvtQkjCWMpofMRAbPLXeQommBn+6Pmx/dHq3bc3dl8V9KleSaSOGEHkmsSBFDEDbjklkJgjjBm/JEZCzN/boQ1Kr40TRbYYqRBQjx8dEIXy9g77NFbK5HL1aRnkfachi0WzYwFozNozqDh8Spwnafyom7YvI453msHJIY5HNT5k55JSZyklGSco++u5m3O+rumQ8KsrDAU7cud4mZ5Ia/mndmcmE3htzRBQv8t9d/lbEu1gMu4iTt9y8KrXmChC9BNHWLKRX7MAXJBp2cMMBZGoUPKaxPMLWYXHkgYmLkTPoBO2Jirr/AOn5yficdhrBnjo/OG+fGhd8zNrQg4jlsyX4fLtpHaMWu2hCQtNvOfUS0HTow8eyDxG/Eb1ReUrstwqTSk0TlLCcJR87TdptN33bdezL4Zjw8y9Yr3+jKxDiJZo7VyqznXZ68UdiYgc9shMEM0ZkO1iBnfcw7S0/U3hrxAEZSliJ2jCOSQi5TdghDmyfaz67mj+9g03EP3Mzt3TFYZzZMYXxRKideOjjQqY+nSv1AoxXrDzl1KSrLZsvkT1kGzzKNTa7DtEYGba+4tfnN4rXuVdjijYTvZCC7DasWJLdqq0Z46Was00mjzRTS4nGuerD2raM2hOyz5cq9YO8tL4l8XJ7x2TKo4+cqWYdkuTntR17E93H5ELNQJW0hjCzjoH5L7t4/aROwjp38T4qVCLIDYxY16+Vizly/BBasTdQy+VolV7SP91GsTmbMI67OaT6vozNkqJ0g7y1Oh4z2IYzrhS5NMI6MdCvSydirNSGhVenGL2xZztCUehFuYX3Czi4t2VQbivXJY7Iy1Al6THh42qvI7R2Gw1OpUh5ps2rNJ5OMiFmdvuIfx3VbROsJN5lotfxcvSRlHk60WTaUsiExkAUJJKeWrhHfqbqIiwuc8NeZptHNih0fcxOvjkvFCeSvdqw0o68F3GUcfWDmnOWOGnRkxRz1pJfuKabGzWK5uX8S699rKgInWCLy0ut4vTRSvZixsIW7slI8zOU8xhkwpULGOGNoOzUWOvancnjd33kJNozbX62N8SoqmNu4ylhwqwX4MjXF2vyynHHkaQU5HmMhYrkkbiZxuTiwtMY7fwSz1E6QuyWoU/GGWOxbsNj+W+Vjxr3XqZSxVlO5jIpIILcMwsTwAUMjiUGhD2EmJnbVU/D8aZSlzmpXpKwWbB2JAjJi3SyabjMpGcjPRhbV376KvorFYhJtMrPw9xXHDVno36A5SnZuDkGiK3NSnhvDEcDzxWa+ruJwyOJgQuz7QdtHbvOY7xQKuMBRY2MLdWpWxoXWtTPriamTiyUVLyxahzX5McL2HdycB/G59yzxEmIki0wvFLxFMDbm0QmhkscTSWYPMSR86LieGvBahGUG1ieIa7bT0fXc+rNopyv4zSQw0IYMXHEGMlqygLXJeURVMbexo7ItukTmF45TLUnORiJ3+7QcrRTrC95X7BeKVulOdiCtG0px8OAzmZmLf8AZyEIIncW0cueAvu7s4bvtd9GdfDi/wAQ5MhBarPXIIrvTtGs5KW+cHTpcjMDRHMI6AZZAtR07crXUnJ9KQivWDvK1cM8YDj6F6rBSd7GVo2qFm4WSsNAde2JATnjB/RknjjJ2AyLQXZi0d21Vk4p8YbOQa3zarieSo3qtlnyU8tbmXxgaaxWqSNtraPC7sGp/wC5t3MwsyzFFJrEp3lfcZ4o24IMRX8uBhg4r0Tk5OJ3Rs0rWPqeYdm7eUr3JwjYfyxuz/w7ffFeKT17QXhxovemxkeLyduPITwleqw1q1aEogFnGhZFqNMnkDcxPEX2sxOz52idIO8r9xH4klcoXqJVDLqViOfn3cnLfesUctc2krRzj+jaKOu0RSgQsQGTOP40oKIrEYSZyIiKoIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgIiICIiApngXNtjcnQvlG8oULUc0kQEwmcbPpI0ZF2GXY5OLv23MKhkQhrPGniNTGkVPGxhZe9UCtZtFDZp8gI8bWxDiFM3eMXOhCQMEZkETyzOxHvHZ0j8YbLlEL15Srw1rsLDPn7s98ZLz1OZYrZSbWSoYBShABANGCSwz73lMnzNFnrDU8ktRy/inDLE9lscPVZL2dlik8xM0NCPK4rGYrmsL/wDrCc4q9gjeR21l/UfXe4roH4q2HslZ8lHqWUs5LZzj2tJZwzYYotdP2NG3M1/Ll27Ms9ROsGyXAtozN/TM3sy5RFpkREQEREBERAREQEREBERAREQEREBERAREVBERQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQERXive4fejjIigeO7DajLJWCrHOxRcx3mN/1BGxE8W1hgYRdnbVz/ACxSViMqOi1MMvwhu3PS2g0ju8LVbBPy3s1JNrTlLuNxGO9p9obgs1wdx5ZboirJwy1u69hpZatt6nk/JwlE9NmcprmjTHqxEcUUYt+owBakZtXFiTJNVDRaOB8HFHueO1HLo/6G5zBnaKxt0m112lK9XXUX2sJ/u10bq5GXhUJYHqxWDjHIQPY8wWu7HkBBbEBF2fzA6iYPubUxf/p7Jk6qEi1MshwSe9/JWIdz7GZjInCKTbYPltq/+oCU5YAlItNkMLuL7jcYrD2uFypVmvQTtehrRBMNLUIpJWlcppDlkZyOUhdm2/sEd20tXEAmV6qCi0OlY4QcQaWC2OkrHIzmLk8csPMKAZY+7tFYcIWN2dyjilNmY5GZo8n4djsmQtLPUlxmkdd94zwZEJKjvvnfaMkcjBa+8RbQZdGFn0daymFMRXSQeGeoxEJWOlvFIMsLj/qhlZi5chSM+0hd3ZmEGbRgj3fk12sJa4WcrMdutOMT2nenMMhHMNZhqiJSOGm6Uia0Tx6bW1YWIdWNpleqgotC4WzHDNarC1igdu7HWlGeSxAzwSzyzxWYiEN5CPJYTgd3Ft4/xoRMu/eu8FyFIbV7APsEa8QRcqNieJ4ylmeEtS0PSRxbvqzM3Z3FTJ1Zciu3EI8MvPUKiViOuF1vPQzjz5ZaW6u7vHJ+mMU+0bLbGYm1MX36MzN28rf4XOSicNWWOKM8jLdg5bBI5WT59CvzGIuZDXJ+V/kGbV37qxJ1Z8i1LJzcGRckAhmm51Q7EkgmbvDam/SjgleJ+4RhpK8YdmJmb/qIGhqc3C3NuNJDZKEisFRJpXicA5NFq0R9jc35xZF3k2tu5Nf7QYyEWTqoyLQsjLweztyIbhiRk7mUoxmIi1mRmaImdm3mNWL977QmI3beDiXS4vk4b8pMOJGcbD3K0kRXh5hPWCKYJohkHaMW45Y5HZxd90BMz7djpEk1wpSIirIiIgIiICIioIiKAiIgIiICIiAiIgIiICIiAiIgIiICIiAiIgK++GnhwWcD9GacJzOaON48HPZxsckUXNjG7lQNo6nM0cf2Ht1F3/LKhLT+CeLsjRpYySrjIMk/D1m3NRt625zpefNjuQW6VWQGffobNLIGjMf2E7sLtz5bxWMzOP5dOOk2mcRl0ZfC2x5O/dhstPFTxGKylJhqmBZKPJRSTyQQtq/LmrRwWnP92rwafbubTtcS+FTUKt6yV87Q423cpSFjcQdyvDbowwnNHk5xkF8WBTyHEJuEjPyDN9G+1o7h3xUyFCPD1xiikj4aO60MNgJC8xFcjsRPVvfczyQRBbssA9tvNfXVSnhnlbe6zYjpxw3rr2In4gtdU2yFlTkhkjlhrl5K1JusntaQezmL7Tce3K/NFI7Wn4604ZvOKx9ZguV+54mjIgYmJoicGMX1EmB9rELv+RfTVnX4XoicxmHnmMTgREVQRQXWJfSPsXynWJfSPsXyuW6rtosnUUF1iX0j7F8p1iX0j7F8puqaLJ1FBdYl9I+xfKdYl9I+xfKbqmiydRQXWJfSPsXynWJfSPsXym6posnUUF1iX0j7F8p1iX0j7F8puqaLJ1FBdYl9I+xfKdYl9I+xfKbqmiydRQXWJfSPsXynWJfSPsXym6posnUUF1iX0j7F8p1iX0j7F8puqaLJ1FBdYl9I+xfKdYl9I+xfKbqmiydRQXWJfSPsXynWJfSPsXym6posnUUF1iX0j7F8p1iX0j7F8puqaLJ1FBdYl9I+xfKdYl9I+xfKbqmiydRQXWJfSPsXynWJfSPsXym6posnUUF1iX0j7F8p1iX0j7F8puqaLJ1FBdYl9I+xfKdYl9I+xfKu6posnUUF1iX0j7F8p1iX0j7F8qbqmiydRQXWJfSPsXynWJfSPsXym6posnUUF1iX0j7F8p1iX0j7F8puqaLJ1FBdYl9I+xfKdYl9I+xfKbqmiydRQXWJfSPsXynWJfSPsXym6posnUUF1iX0j7F8p1iX0j7F8puqaLJ1FBdYl9I+xfKdYl9I+xfKbqmiydRQXWJfSPsXynWJfSPsXym6posnUUF1iX0j7F8p1iX0j7F8puqaLJ1FBdYl9I+xfKdYl9I+xfKbqmiydRQXWJfSPsXynWJfSPsXym6posnV96F2avI0teY68o9hlglKKRmfTVt4aPtfRu34dVvrEvpH2L5TrEvpH2L5UnlpMYn8LXivWcx+f5aQ3iTntNOpE+n8nUpyF/8Ackjc/wDzULlc/etyDLZuSTyR68spJXfl6to/KFtBi1bX9rN+VUesS+kfYvlOsS+kfYvlcOPh/wAbjnNKRE/tWHfk5f8AJ5Ixa8zH72lOMuVBdYl9I+xfKdYl9I+xfK9G6rz6LJ1FBdYl9I+xfKdYl9I+xfKbqmiyNREXke0REQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREH/9k=\n",
      "text/html": [
       "\n",
       "        <iframe\n",
       "            width=\"400\"\n",
       "            height=\"300\"\n",
       "            src=\"https://www.youtube.com/embed/d21JrnszG7Y\"\n",
       "            frameborder=\"0\"\n",
       "            allowfullscreen\n",
       "        ></iframe>\n",
       "        "
      ],
      "text/plain": [
       "<IPython.lib.display.YouTubeVideo at 0x7f81d9ccc400>"
      ]
     },
     "execution_count": 19,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "from IPython.display import YouTubeVideo\n",
    "YouTubeVideo('d21JrnszG7Y')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Customer Key Store (CMK stored within AWS CloudHSM) "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<blockquote>For most users, the default AWS KMS key store, which is protected by FIPS 140-2 validated cryptographic modules, fulfills their security requirements. \n",
    "\n",
    "However, you might consider creating a custom key store if your organisation has any of the following requirements \n",
    "\n",
    "* The key material cannot be stored in a shared environment \n",
    "* The key material must be backed up in multiple AWS Regions \n",
    "* The key material must be subject to a secondary, independent audit path \n",
    "* The hardware security module (HSM) that generates and stores key material must be certified at FIPS 140-2 Level 3 \n",
    "\n",
    "If any of these apply then its worth considering AWS CloudHSM with AWS KMS to create a custom key store. "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Pre-requisite"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Check your variables are loaded"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%store"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Load in variable store"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%store -r "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Load variables into notebook"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%env AWS_PROFILE=$AWS_PROFILE\n",
    "%env AWS_DEFAULT_REGION=$AWS_DEFAULT_REGION\n",
    "%env ACCOUNT_ID=$ACCOUNT_ID"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Check identity "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!aws sts get-caller-identity"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<br>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "---\n",
    "---"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## <br><br> Create a Secret "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Create a namespace for this exercise"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!kubectl create ns secretslab"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Create a text file containing your secret "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!echo \"Visit Adnan.Study for Adnan's techie Notes! \" > temp/test-creds"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Create your secret"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash \n",
    "\n",
    "kubectl create secret \\\n",
    "         generic test-creds \\\n",
    "         --from-file=test-creds=temp/test-creds \\\n",
    "         --namespace secretslab"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Retrieve the secret via the CLI "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!kubectl get secret test-creds -o jsonpath=\"{.data.test-creds}\" --namespace secretslab | base64 --decode"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<br><br>At the end of this lab, we will validate the Decrypt API call in CloudTrail. \n",
    "\n",
    "It will take some time for the event to be viewable in CloudTrail. \n",
    "\n",
    "For now lets attempt retrieve the secret using a pod"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## <br><br> Access the Secret from a Pod "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Deploy a Pod to Consume the Secret "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!cat secrets/podconsumingsecret.yaml"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!kubectl --namespace secretslab apply -f secrets/podconsumingsecret.yaml"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Attach to the pod and attempt to access the secret"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!kubectl --namespace secretslab exec -it consumesecret -- cat /tmp/test-creds"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Check Cloudtrail to see the decryption via KMS"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=Decrypt --max-items=1 --region eu-west-1"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.3"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}