SOPS

Encryption Commands

Encrypt YAML, JSON, ENV, and INI files using age, PGP, AWS KMS, GCP KMS, or Azure Key Vault.

10 commands

Pro Tips

Use age keys for simpler local encryption without cloud dependencies

Use --encrypted-regex to encrypt only specific keys

Commands

Encrypt file with age

$ sops -e --age age1xxx secrets.yaml > secrets.enc.yaml

Encrypt YAML file using age key.

Encrypt in place

$ sops -e -i secrets.yaml

Encrypt file in place.

Encrypt with AWS KMS

$ sops -e --kms arn:aws:kms:us-east-1:123:key/xxx secrets.yaml

Encrypt using AWS KMS key.

Encrypt specific keys

$ sops -e --encrypted-regex '^(password|secret)$' config.yaml

Encrypt only matching keys.

Encrypt JSON

$ sops -e secrets.json > secrets.enc.json

Encrypt JSON file.

Encrypt with GCP KMS

$ sops -e --gcp-kms projects/myproj/locations/global/keyRings/myring/cryptoKeys/mykey secrets.yaml

Encrypt using Google Cloud KMS.

Encrypt with Azure Key Vault

$ sops -e --azure-kv https://myvault.vault.azure.net/keys/mykey/version secrets.yaml

Encrypt using Azure Key Vault.

Encrypt with multiple keys

$ sops -e --age age1key1,age1key2 secrets.yaml

Encrypt for multiple age recipients.

Exclude keys from encryption

$ sops -e --unencrypted-regex '^(metadata|description)$' config.yaml

Leave matching keys unencrypted.

Encrypt .env file

$ sops -e --input-type dotenv --output-type dotenv .env > .env.enc

Encrypt a dotenv file.