credstash | A little utility for managing credentials in the cloud | Azure library

(Linux only) Install dependencies
pip install credstash
Set up a key called credstash in KMS (found in the IAM console)
Make sure you have AWS creds in a place that boto/botocore can read them
credstash setup
credstash will not currently set up your KMS master key. To create a KMS master key,.
Go to the AWS Console and make sure you are in us-east-1. If you want to use a key in a different region, you can pass it in using the --kms-region argument.
Go to the KMS Console
Click "Customer managed keys" in the left sidebar
Click "Next" to configure a Symmetric key
For alias, put "credstash" and click "Next". If you want to use a different name, be sure to pass it to credstash with the -k flag.
Decide what IAM principals, if any, you want to be able to manage the key. Click "Next".
On the "Key Usage Permissions" screen, pick the IAM users/roles that will be using credstash (you can change your mind later). Click "Next".
Review the key policy and click "Finish".
Done!
The easiest thing to do is to just run pip install credstash. That will download and install credstash and its dependencies (boto and PyCypto). You can also install credstash with optional YAML support by running pip install credstash[YAML] instead. The second easiest thing to do is to do python setup.py install in the credstash directory. The python dependencies for credstash are in the requirements.txt file. You can install them with pip install -r requirements.txt. In all cases, you will need a C compiler for building PyCrypto (you can install gcc by doing apt-get install gcc or yum install gcc). You will need to have AWS credentials accessible to boto/botocore. The easiest thing to do is to run credstash on an EC2 instance with an IAM role. Alternatively, you can put AWS credentials in the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables. Or, you can put them in a file (see http://boto.readthedocs.org/en/latest/boto_config_tut.html). You can specify the region in which credstash should operate by using the -r flag, or by setting the AWS_DEFAULT_REGION environment variable. Note that the command line flag takes precedence over the environment variable. If you set neither, then credstash will operate against us-east-1. Once credentials are in place, run credstash setup. This will create the DDB table needed for credential storage.
In order to run credstash setup, you will also need to be able to perform the following DDB operations:.