README.md in kms_encrypted-1.2.1 vs README.md in kms_encrypted-1.2.2

- old
+ new

@@ -12,11 +12,11 @@ Supports [AWS KMS](https://aws.amazon.com/kms/), [Google Cloud KMS](https://cloud.google.com/kms/), and [Vault](https://www.vaultproject.io/) Check out [this post](https://ankane.org/sensitive-data-rails) for more info on securing sensitive data with Rails -[![Build Status](https://travis-ci.org/ankane/kms_encrypted.svg?branch=master)](https://travis-ci.org/ankane/kms_encrypted) +[![Build Status](https://github.com/ankane/kms_encrypted/workflows/build/badge.svg?branch=master)](https://github.com/ankane/kms_encrypted/actions) ## How It Works This approach uses a key management service (KMS) to manage encryption keys and Lockbox / attr_encrypted to do the encryption. @@ -65,11 +65,11 @@ ### Google Cloud KMS Add this line to your application’s Gemfile: ```ruby -gem 'google-api-client' +gem 'google-apis-cloudkms_v1' ``` Create a [Google Cloud Platform](https://cloud.google.com/) account if you don’t have one. KMS works great whether or not you run your infrastructure on GCP. Create a [KMS key ring and key](https://console.cloud.google.com/iam-admin/kms) and set it in your environment along with your GCP credentials ([dotenv](https://github.com/bkeepers/dotenv) is great for this) @@ -333,12 +333,18 @@ ```sh KMS_KEY_ID=insecure-test-key ``` +In a Rails application, you can also create `config/initializers/kms_encrypted.rb` with: + +```ruby +KmsEncrypted.key_id = Rails.env.test? ? "insecure-test-key" : ENV["KMS_KEY_ID"] +``` + ## Key Rotation -Key management services allow you to rotate the master key. +Key management services allow you to rotate the master key without any code changes. AWS KMS supports [automatic key rotation](https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html). For Google Cloud, use the Google Cloud Console or API.