Repository navigation
Fix for KMS Secret ID's not being applied to split passphrase secret - #12
Merged
Merged
Conversation
Adds an optional IncludeChain store-type property (default false) that writes the issuer chain into the single concatenated PEM secret (leaf, then chain leaf-first, then private key). Ignored when SeparatePrivateKey is enabled, since the JSON format already includes the chain. A missing property reads as false, so existing stores are unchanged after upgrade. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Inventory calls BatchGetSecretValue and management operations call DescribeSecret; both fail without these IAM actions but they were not listed in the documentation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Adds UntagResource, ReplicateSecretToRegions, and RemoveRegionsFromReplication (called when using tags or replica regions) and fixes the action names to the secretsmanager:<Action> form so they can be pasted directly into an IAM policy. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
UpdateSecretTagsAsync computed the tag keys that overlap with the new tags but then untagged every existing tag on the secret whenever any key overlapped, wiping tags not managed by Keyfactor. Only the overlapping keys are now removed before re-tagging; other tags are kept. Also adds the .NET 10 target to the changelog. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
When an AWSSMPEM secret failed to parse during inventory, the full secret value (including the unencrypted private key) was logged at the Warning level. The warning now contains only the secret name and the parse error; the malformed warning message is also fixed. The raw store properties trace now redacts Secret-type fields (OAuth client ID/secret, IAM user access key/secret). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…place For AWSSMPFX / AWSSMJKS stores the <alias>-pw secret was always encrypted with the default aws/secretsmanager key and was never replicated, because KmsKeyId and ReplicaRegions were only applied to the cert store secret. On renewal / overwrite the password UpdateSecretRequest was built but never sent, so the -pw secret kept the old password while the cert store was protected with the new one. The identification and entry tags are still not applied to the password secret, so inventory does not pick it up as a cert store. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
indrora
added a commit
that referenced
this pull request
Oct 23, 2026
* Add IncludeChain store property for AWSSMPEM, Documentation updates (#9) * Add IncludeChain store property for AWSSMPEM Adds an optional IncludeChain store-type property (default false) that writes the issuer chain into the single concatenated PEM secret (leaf, then chain leaf-first, then private key). Ignored when SeparatePrivateKey is enabled, since the JSON format already includes the chain. A missing property reads as false, so existing stores are unchanged after upgrade. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: add BatchGetSecretValue and DescribeSecret to required permissions Inventory calls BatchGetSecretValue and management operations call DescribeSecret; both fail without these IAM actions but they were not listed in the documentation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: complete and correct the IAM permissions list Adds UntagResource, ReplicateSecretToRegions, and RemoveRegionsFromReplication (called when using tags or replica regions) and fixes the action names to the secretsmanager:<Action> form so they can be pasted directly into an IAM policy. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Add net10.0 target framework Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Only untag overlapping keys when updating secret tags UpdateSecretTagsAsync computed the tag keys that overlap with the new tags but then untagged every existing tag on the secret whenever any key overlapped, wiping tags not managed by Keyfactor. Only the overlapping keys are now removed before re-tagging; other tags are kept. Also adds the .NET 10 target to the changelog. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Stop logging secret contents and credentials When an AWSSMPEM secret failed to parse during inventory, the full secret value (including the unencrypted private key) was logged at the Warning level. The warning now contains only the secret name and the parse error; the malformed warning message is also fixed. The raw store properties trace now redacts Secret-type fields (OAuth client ID/secret, IAM user access key/secret). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Update generated docs * Update keyfactor-release-workflow.yml update to v5 * Update keyfactor-release-workflow.yml * docs: auto-generate README and documentation [skip ci] --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> Co-authored-by: Morgan Gangwere <470584+indrora@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * Update integration-manifest.json (#10) * docs: auto-generate README and documentation [skip ci] * Fix for KMS Secret ID's not being applied to split passphrase secret (#12) * Add IncludeChain store property for AWSSMPEM Adds an optional IncludeChain store-type property (default false) that writes the issuer chain into the single concatenated PEM secret (leaf, then chain leaf-first, then private key). Ignored when SeparatePrivateKey is enabled, since the JSON format already includes the chain. A missing property reads as false, so existing stores are unchanged after upgrade. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: add BatchGetSecretValue and DescribeSecret to required permissions Inventory calls BatchGetSecretValue and management operations call DescribeSecret; both fail without these IAM actions but they were not listed in the documentation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs: complete and correct the IAM permissions list Adds UntagResource, ReplicateSecretToRegions, and RemoveRegionsFromReplication (called when using tags or replica regions) and fixes the action names to the secretsmanager:<Action> form so they can be pasted directly into an IAM policy. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Add net10.0 target framework Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Only untag overlapping keys when updating secret tags UpdateSecretTagsAsync computed the tag keys that overlap with the new tags but then untagged every existing tag on the secret whenever any key overlapped, wiping tags not managed by Keyfactor. Only the overlapping keys are now removed before re-tagging; other tags are kept. Also adds the .NET 10 target to the changelog. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Stop logging secret contents and credentials When an AWSSMPEM secret failed to parse during inventory, the full secret value (including the unencrypted private key) was logged at the Warning level. The warning now contains only the secret name and the parse error; the malformed warning message is also fixed. The raw store properties trace now redacts Secret-type fields (OAuth client ID/secret, IAM user access key/secret). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Update generated docs * Apply KMS key and replicas to password secret; update its value on replace For AWSSMPFX / AWSSMJKS stores the <alias>-pw secret was always encrypted with the default aws/secretsmanager key and was never replicated, because KmsKeyId and ReplicaRegions were only applied to the cert store secret. On renewal / overwrite the password UpdateSecretRequest was built but never sent, so the -pw secret kept the old password while the cert store was protected with the new one. The identification and entry tags are still not applied to the password secret, so inventory does not pick it up as a cert store. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Update generated docs * Move password secret fixes to 1.2.1 in changelog Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * added changelog to solution items * docs: auto-generate README and documentation [skip ci] --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * Update integration-manifest.json (#13) --------- Co-authored-by: Joe VanWanzeele <76071503+joevanwanzeeleKF@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
<alias>-pw) ignoring theKmsKeyIdentry parameter; it was always encrypted with the defaultaws/secretsmanagerkey. It is now encrypted with the same KMS key as the certificate secret, and is also replicated to the regions provided inReplicaRegions.