Secrets Manager Storage

This plugin enables Fastlane users to store their provisioning profiles and signing keys securely in AWS Secrets Manager by adding a secrets_manager storage backend to Fastlane match.

Reasons to use this (compared to the git or s3 backend):

• your signing keys are stored securley (always encrypted) by default
• all access is controlled via AWS IAM and is fine-grained:
  • users can be granted access to review the secret's metadata separate from the ability to read the actual, unencrypted values
  • no need to manage a MATCH_PASSWORD – just use your existing AWS access controls
• all access to the decrypted keys is logged into AWS CloudTrail, providing an audit-trail to access
• Secret lifecycle can be tracked independently of Fastlane, enabling you to have alerts on secret age by using the secret's version metadata (e.g. Created On). This is interesting because Apple provides no means of being notified about certificate expiration.
  • certificates and mobileprovision Secrets will be tagged with ExpiresOn and other metadata

ℹ️ Fastlane plugins are only automatically loaded when using a Fastfile. This means that using a Matchfile or fastlane match commands will not work with this storage backing. We're happy to take contributions but we've always ended up writing Fastlane actions in our projects anyway (not using the match commands or Matchfile)

Getting Started

This project is a fastlane plugin. To get started with fastlane-plugin-secrets_manager_storage, add it to your project by running:

fastlane add_plugin secrets_manager_storage

You will then need to modify your Fastfile to have actions which use match/sync_code_signing use the secrets_manager storage backend. You can look in fastlane/Fastfile in this repository for example use.

You will need to ensure that you have properly configured the environment to be able to access Secrets Manager. If you use IAM Users then you may want to set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY_ID appropriately. AWS documentation explains how credentials are loaded.

Formatting

This project is formatted using Prettier. Simply run `rake prettier' to format

rake prettier

Development setup

bundle install
yarn install

How to contribute

See our guide on contributing.

Release History

See our changelog.

About fastlane

fastlane is the easiest way to automate beta deployments and releases for your iOS and Android apps. To learn more, check out fastlane.tools.

License

Copyright © 2024 Klarna Bank AB

For license details, see the LICENSE file in the root of this project.