fintechner cold backup keys reveal

31-cold-backup-keys.sh

#!/bin/bash
# fintechner — gate #7: print all critical secrets to terminal so you can
# write them on paper / save to password manager. NEVER paste output to chat.
#
# If AWS Secrets Manager has a regional outage you cannot re-sign or
# decrypt the credential store. These are your only fallbacks.
set -euo pipefail
export AWS_PAGER=""
REGION=ap-northeast-1

clear
echo "=================================================================="
echo "  fintechner — COLD BACKUP OF CRITICAL SECRETS"
echo "=================================================================="
echo
echo "Write each secret on paper or paste into 1Password / Bitwarden."
echo "After you've saved them, type   clear   to wipe the screen."
echo
echo "Press Enter to reveal..."
read -r _

echo
echo "-- 1. MASTER_ENCRYPTION_KEY (decrypts HL credentials in DB) --"
aws --region "$REGION" secretsmanager get-secret-value \
  --secret-id fintechner/master-encryption-key \
  --query SecretString --output text
echo

echo "-- 2. HL agent private key --"
HL=$(aws --region "$REGION" secretsmanager get-secret-value \
  --secret-id fintechner/hl-agent-key \
  --query SecretString --output text 2>/dev/null || echo "(not yet set)")
echo "$HL"
echo

echo "-- 3. TimescaleDB password (less critical — regenerable) --"
aws --region "$REGION" secretsmanager get-secret-value \
  --secret-id fintechner/db-password \
  --query SecretString --output text
echo

echo "-- 4. AWS account ID (for re-onboarding) --"
aws sts get-caller-identity --query Account --output text
echo "-- 5. EC2 instance ID --"
echo "i-089ad4a6b76132ba2"
echo "-- 6. Elastic IP --"
echo "13.193.136.150"
echo

echo "=================================================================="
echo "Done. SAVE THESE NOW. After saving, type:  clear"
echo "=================================================================="