cc @snstanton

Codecov Report

❗ No coverage uploaded for pull request base (master@e398d1c). Click here to learn what that means.
The diff coverage is 0%.

@@            Coverage Diff            @@
##             master     #415   +/-   ##
=========================================
  Coverage          ?   43.38%           
=========================================
  Files             ?       16           
  Lines             ?     2206           
  Branches          ?        0           
=========================================
  Hits              ?      957           
  Misses            ?     1160           
  Partials          ?       89

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update e398d1c...7a78a69. Read the comment docs.

lgtm. I'm curious why you prefer using aliases vs the full ARN, though. They seem to be about as hard (read: impossible) to memorize as the ARN, since you'd have to memorize the account id, right?

We have multiple environments, each with its own set of keys. When we generate the key we use the environment name as the alias. This makes it very easy to configure sops since our tooling can derive the list of keys.

I see, good to know!

lgtm. I'm curious why you prefer using aliases vs the full ARN, though. They seem to be about as hard (read: impossible) to memorize as the ARN, since you'd have to memorize the account id, right?

We have multiple environments, each with its own set of keys. When we generate the key we use the environment name as the alias. This makes it very easy to configure sops since our tooling can derive the list of keys.

It's not just that: when the key rotates, the ID changes and you have to adjust the SOPS file. However, with an alias, this change is obsolete as the alias automatically points to the new (rotated) ID.