This is the development version of the SOPS documentation. The documentation for the latest SOPS release can be found on getsops.io.

Identities

SOPS supports PGP, age, various KMSes, and key groups to give access to SOPS encrypted files.

You can use PGP / GnuPG to encrypt data.

You can use age keys to encrypt data.

You can use Amazon AWS’ KMS to encrypt data.

You can use Azure’s KMS to encrypt data.

You can use Google Cloud’s KMS to encrypt data.

You can use HashiCorp Vault or OpenBao to encrypt data.

You can use HuaweiCloud’s KMS to encrypt data.

Key groups allow to require multiple identities together to edit or decrypt a file.

How to use .sops.yaml config files to select which identities to use for new files.