README.md in kms_encrypted-1.2.1 vs README.md in kms_encrypted-1.2.2
- old
+ new
@@ -12,11 +12,11 @@
Supports [AWS KMS](https://aws.amazon.com/kms/), [Google Cloud KMS](https://cloud.google.com/kms/), and [Vault](https://www.vaultproject.io/)
Check out [this post](https://ankane.org/sensitive-data-rails) for more info on securing sensitive data with Rails
-[![Build Status](https://travis-ci.org/ankane/kms_encrypted.svg?branch=master)](https://travis-ci.org/ankane/kms_encrypted)
+[![Build Status](https://github.com/ankane/kms_encrypted/workflows/build/badge.svg?branch=master)](https://github.com/ankane/kms_encrypted/actions)
## How It Works
This approach uses a key management service (KMS) to manage encryption keys and Lockbox / attr_encrypted to do the encryption.
@@ -65,11 +65,11 @@
### Google Cloud KMS
Add this line to your application’s Gemfile:
```ruby
-gem 'google-api-client'
+gem 'google-apis-cloudkms_v1'
```
Create a [Google Cloud Platform](https://cloud.google.com/) account if you don’t have one. KMS works great whether or not you run your infrastructure on GCP.
Create a [KMS key ring and key](https://console.cloud.google.com/iam-admin/kms) and set it in your environment along with your GCP credentials ([dotenv](https://github.com/bkeepers/dotenv) is great for this)
@@ -333,12 +333,18 @@
```sh
KMS_KEY_ID=insecure-test-key
```
+In a Rails application, you can also create `config/initializers/kms_encrypted.rb` with:
+
+```ruby
+KmsEncrypted.key_id = Rails.env.test? ? "insecure-test-key" : ENV["KMS_KEY_ID"]
+```
+
## Key Rotation
-Key management services allow you to rotate the master key.
+Key management services allow you to rotate the master key without any code changes.
AWS KMS supports [automatic key rotation](https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html).
For Google Cloud, use the Google Cloud Console or API.