sops Respect aws_profile from Keygroup Config

A KMS entry in a creation_rule keygroup supports setting aws_profile, but the value is not passed into the KMS MasterKey.

May 02 '22 17:05 Kouzukii

I can confirm that this patch fixes the bug that prevents aws_profile from working when defined in a keygroup.

sample .sops.yml

---
creation_rules:
  - key_groups:
      - kms:
        - arn: arn:aws:kms:eu-west-1......
          aws_profile: my-profile

With latest `master` branch or release version 2.7.3

$ sops --verbose test2.sops.yml
[AWSKMS]         INFO[0006] Encryption failed                             arn="arn:aws:kms:eu-west-1:...redacted..."
Error encrypting the data key with one or more master keys: [failed to encrypt new data key with master key "arn:aws:kms:eu-west-1:...redacted...": Failed to call KMS encryption service: NoCredentialProviders: no valid providers in chain. Deprecated.
        For verbose messaging see aws.Config.CredentialsChainVerboseErrors]

With this patch applied

$ /workspace/go/bin/sops --verbose test2.sops.yml
[AWSKMS]         INFO[0000] Encryption succeeded                          arn="arn:aws:kms:eu-west-1:...redacted..."
[CMD]    INFO[0002] File written successfully