At welthee we are using AWS KMS managed private keys to sign Ethereum transactions.
This little package eases integration with AWS KMS in your GoLang Ethereum project, by extending the functionality offered by the official go-ethereum library.
import "github.com/welthee/go-ethereum-aws-kms-tx-signer/v2"
In order to sign Ethereum transactions with an AWS KMS key you need to create a KMS key in AWS, and grant your application's principal access to use it.
Then, modify your Ethereum transactor code to use the bind.TransactOpts
that this library returns.
Create an AWS KMS Assymetric key with key usage of SIGN_VERIFY
and spec ECC_SECG_P256K1
. Make sure that you add an
appropriate key policy granting your code the following permissions:
kms:GetPublicKey
, kms:Sign
.
Example key policy:
{
"Sid": "AllowSignAndGetPublicKey",
"Effect": "Allow",
"Resource": "*",
"Principal": {
"AWS": [
"arn:aws:iam::111122223333:user/CMKUser",
"arn:aws:iam::111122223333:role/CMKRole",
"arn:aws:iam::444455556666:root"
]
},
"Action": [
"kms:Sign",
"kms:GetPublicKey"
]
}
The abigen
tool generates bindings that are able to directly operate with the *bind.TransactOpts
type.
For instance an IERC20 transactor integrated with the KMS signer would look like this:
var client *ethclient.client
var kmsSvc *kms.KMS
var chainID *big.Int
var erc20Address common.Address
transactor, _ := internal.NewIERC20Transactor(erc20Address, client)
transactOpts := ethawskmssigner.NewAwsKmsTransactorWithChainID(kmsSvc, keyId, chainId)
tx, err := transactor.Transfer(transactOpts, toAddress, big.NewInt(amountInt))
Note how the ethawskmssigner.NewAwsKmsTransactorWithChainID(...)
returns a ready to use *bind.TransactOpts
.
In order to use in manually constructed transactions, you can use the Signer to sign your transaction yourself. Example:
transactOpts, _ := ethawskmssigner.NewAwsKmsTransactorWithChainID(kmsSvc, keyId, clChainId)
tx := types.NewTransaction(nonce, toAddress, value, gasLimit, gasPrice, nil)
signedTx, _ := transactOpts.Signer(transactOpts.From, tx)
err = client.SendTransaction(context.TODO(), signedTx)