mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
91 lines
2.2 KiB
Markdown
91 lines
2.2 KiB
Markdown
# Envelope Encryption with AWS KMS Template
|
|
|
|
## Prerequisites Checklist
|
|
|
|
- [ ] AWS account with KMS access
|
|
- [ ] IAM policy allows kms:GenerateDataKey, kms:Decrypt, kms:ReEncrypt
|
|
- [ ] KMS Customer Managed Key (CMK) created
|
|
- [ ] CloudTrail logging enabled for KMS events
|
|
- [ ] boto3 and cryptography Python libraries installed
|
|
|
|
## IAM Policy Template
|
|
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"kms:GenerateDataKey",
|
|
"kms:Decrypt",
|
|
"kms:ReEncrypt*",
|
|
"kms:DescribeKey"
|
|
],
|
|
"Resource": "arn:aws:kms:us-east-1:123456789012:key/your-key-id"
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
## KMS Key Policy Template
|
|
|
|
```json
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Sid": "AllowKeyAdministration",
|
|
"Effect": "Allow",
|
|
"Principal": {"AWS": "arn:aws:iam::123456789012:role/KeyAdmin"},
|
|
"Action": [
|
|
"kms:Create*", "kms:Describe*", "kms:Enable*", "kms:List*",
|
|
"kms:Put*", "kms:Update*", "kms:Revoke*", "kms:Disable*",
|
|
"kms:Get*", "kms:Delete*", "kms:ScheduleKeyDeletion",
|
|
"kms:CancelKeyDeletion"
|
|
],
|
|
"Resource": "*"
|
|
},
|
|
{
|
|
"Sid": "AllowKeyUsage",
|
|
"Effect": "Allow",
|
|
"Principal": {"AWS": "arn:aws:iam::123456789012:role/AppRole"},
|
|
"Action": ["kms:Decrypt", "kms:GenerateDataKey", "kms:ReEncrypt*"],
|
|
"Resource": "*"
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
## Quick Reference
|
|
|
|
```python
|
|
import boto3
|
|
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
|
|
import os
|
|
|
|
kms = boto3.client('kms')
|
|
|
|
# Encrypt
|
|
resp = kms.generate_data_key(KeyId='alias/my-key', KeySpec='AES_256')
|
|
plaintext_key = resp['Plaintext']
|
|
encrypted_key = resp['CiphertextBlob']
|
|
|
|
nonce = os.urandom(12)
|
|
ciphertext = AESGCM(plaintext_key).encrypt(nonce, data, None)
|
|
# Store: encrypted_key + nonce + ciphertext
|
|
|
|
# Decrypt
|
|
resp = kms.decrypt(CiphertextBlob=encrypted_key)
|
|
plaintext_key = resp['Plaintext']
|
|
data = AESGCM(plaintext_key).decrypt(nonce, ciphertext, None)
|
|
```
|
|
|
|
## Cost Estimation
|
|
|
|
| Operation | Price | Notes |
|
|
|-----------|-------|-------|
|
|
| KMS API requests | $0.03 per 10,000 | GenerateDataKey, Decrypt |
|
|
| CMK storage | $1.00 per month | Per customer managed key |
|
|
| Key rotation | Free | Automatic annual rotation |
|