SopsSyncProvider
For most use cases you don't need to create it yourself — SopsSecret, SopsStringParameter and MultiStringParameter create one and derive the required IAM permissions from your input automatically.
Some use cases require changing the provider's defaults. In that case, create it yourself and pass it to the other constructs. Note that SopsSyncProvider is a SingletonLambda — it can only exist once per stack.
const provider = new SopsSyncProvider(this, 'MySopsSyncProvider', {
role: customRole, // you can pass a custom role
vpc: customVpc, // The default SopsSync Provider
vpcSubnets: { // won't run in any VPC,
subnets: [ // as it does not require
customSubnet1, // access to any VPC resources.
customSubnet2, // But if you want,
] // you can change this behaviour
}, // and set vpc, subnet and
securityGroups: [ // security groups to your
customSecurityGroup // needs.
],
logGroup: new LogGroup(this, 'MyLogGroup', { // you can add a custom log group
retention: RetentionDays.THREE_MONTHS, // with a custom retention period
encryptionKey: new KmsKey(this, 'MyKmsKey') // and custom encryption
}),
uuid: 'MySopsSyncProvider', // Create a custom singleton by changing default uuid.
});
provider.addToRolePolicy( // You can pass PolicyStatements
new PolicyStatement({ // via the addToRolePolicy Method
actions: ['...'],
resources: ['...'],
})
);
kmsKey.grantDecrypt( // The provider implements
provider // the IGrantable interface,
); // so you can use it as grant target
const secret = new SopsSecret(this, 'MySecret', {
sopsProvider: provider, // this property is available in all Constructs
...
});Want to keep the SOPS age private key out of the Lambda's plaintext configuration? See Age Key from SSM Parameter Store.