ethawskmssigner

package module
v0.0.0-...-e0388d0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: May 24, 2022 License: MIT Imports: 15 Imported by: 0

README

gopher

AWS KMS transaction signer for go-ethereum

At welthee we are using AWS KMS managed private keys to sign Ethereum transactions.

This little package eases integration with AWS KMS in your GoLang Ethereum project, by extending the functionality offered by the official go-ethereum library.

Import

import "github.com/welthee/go-ethereum-aws-kms-tx-signer"

Usage

In order to sign Ethereum transactions with an AWS KMS key you need to create a KMS key in AWS, and grant your application's principal access to use it.

Then, modify your Ethereum transactor code to use the bind.TransactOpts that this library returns.

Create an AWS KMS key

Create an AWS KMS Assymetric key with key usage of SIGN_VERIFY and spec ECC_SECG_P256K1. Make sure that you add an appropriate key policy granting your code the following permissions: kms:GetPublicKey, kms:Sign.

Example key policy:

{
  "Sid": "AllowSignAndGetPublicKey",
  "Effect": "Allow",
  "Resource": "*",
  "Principal": {
    "AWS": [
      "arn:aws:iam::111122223333:user/CMKUser",
      "arn:aws:iam::111122223333:role/CMKRole",
      "arn:aws:iam::444455556666:root"
    ]
  },
  "Action": [
    "kms:Sign",
    "kms:GetPublicKey"
  ]
}
Your transactor code

The abigen tool generates bindings that are able to directly operate with the *bind.TransactOpts type.

For instance an IERC20 transactor integrated with the KMS signer would look like this:

var client *ethclient.client
var kmsSvc *kms.KMS
var chainID *big.Int
var erc20Address common.Address

transactor, _ := internal.NewIERC20Transactor(erc20Address, client)

transactOpts := ethawskmssigner.NewAwsKmsTransactorWithChainID(kmsSvc, keyId, chainId)

tx, err := transactor.Transfer(transactOpts, toAddress, big.NewInt(amountInt))

Note how the ethawskmssigner.NewAwsKmsTransactorWithChainID(...) returns a ready to use *bind.TransactOpts.

In order to use in manually constructed transactions, you can use the Signer to sign your transaction yourself. Example:

transactOpts, _ := ethawskmssigner.NewAwsKmsTransactorWithChainID(kmsSvc, keyId, clChainId)
tx := types.NewTransaction(nonce, toAddress, value, gasLimit, gasPrice, nil)
signedTx, _ := transactOpts.Signer(transactOpts.From, tx)	
err = client.SendTransaction(context.TODO(), signedTx)

Further reading

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL