SOPS

Key Management Commands

Add, remove, and rotate encryption keys. Configure key groups for multi-party access control.

8 commands

Pro Tips

Use .sops.yaml to configure default keys per directory

Commands

Rotate data key

$ sops -r secrets.enc.yaml

Rotate the data encryption key.

Add new key

$ sops updatekeys --add-age age1newkey secrets.enc.yaml

Add a new age key to file.

Remove key

$ sops updatekeys --rm-age age1oldkey secrets.enc.yaml

Remove an age key from file.

Generate age key

$ age-keygen -o keys.txt

Generate new age keypair.

Add KMS key to file

$ sops updatekeys --add-kms arn:aws:kms:us-east-1:123:key/xxx secrets.enc.yaml

Add an AWS KMS key to encrypted file.

Remove KMS key from file

$ sops updatekeys --rm-kms arn:aws:kms:us-east-1:123:key/xxx secrets.enc.yaml

Remove an AWS KMS key from file.

Set SOPS_AGE_KEY_FILE

$ export SOPS_AGE_KEY_FILE=~/.config/sops/age/keys.txt

Set age key file path via env var.

Rotate data key in place

$ sops -r -i secrets.enc.yaml

Rotate and write data key in place.