symfony / flysystem-key-management

8.2.x-dev 2026-09-14 08:33 UTC

Requires

• php: >=8.4.1
• league/flysystem: ^3.0
• psr/container: ^1.1|^2.0
• symfony/key-management: ^8.2

Requires (Dev)

• symfony/dependency-injection: ^7.4|^8.0

MIT

• Jérôme Tamarelle
• Florent Morselli
• Symfony Community

• encryption
• Flysystem
• kms

Published on Packagist.org on 2026-09-14 08:46 UTC

README

Provides a FlysystemKeyLoader and a matching FlysystemKmsFactory that let the local KMS backends shipped by symfony/key-management (SodiumKms, OpenSslKms, SealedBoxKms) source their key material through any league/flysystem reader: S3, FTP, SFTP, Azure Blob, Google Cloud Storage, ...

This Bridge is experimental. Experimental features are not covered by Symfony's Backward Compatibility Promise.

use League\Flysystem\AwsS3V3\AwsS3V3Adapter;
use League\Flysystem\Filesystem;
use Symfony\Component\KeyManagement\Bridge\Flysystem\FlysystemKeyLoader;
use Symfony\Component\KeyManagement\Local\OpenSslKms;

$flysystem = new Filesystem(new AwsS3V3Adapter(/* ... */));

$kms = new OpenSslKms(new FlysystemKeyLoader($flysystem, 'keys', '.bin'));

$ciphertext = $kms->encrypt('app', 'hello world');
$plaintext  = $kms->decrypt($ciphertext);

The loader reads the key from Flysystem on every lookup and caches nothing, so a remote storage costs one read per KMS operation with self-contained envelopes, and one per data key with a data key store.

DSN schemes

When KeyManagementBundle is registered and key_management is configured, this bridge exposes three DSN schemes: one per local backend: that read keys through Flysystem:

• sodium+fly://<flysystem-service-id>/<path>?ext=.bin
• openssl+fly://<flysystem-service-id>/<path>?ext=.bin
• sodium-sealed-box+fly://<flysystem-service-id>/<path>?ext=.bin

<flysystem-service-id> is the host segment of the DSN. With league/flysystem-bundle installed, every storage it declares answers to the name it was given in flysystem.yaml, and there is nothing else to do:

flysystem:
    storages:
        keys.storage:
            adapter: 'asyncaws'
            options: { client: 'app.s3_client', bucket: 'kms-keys' }

key_management:
    clients:
        app: 'sodium+fly://keys.storage/keys?ext=.key'

A Flysystem instance registered by hand, or one that has to answer to another name than its service id, is declared by tagging it key_management.flysystem with a key attribute equal to the host:

services:
    app.keys_filesystem:
        class: League\Flysystem\Filesystem
        arguments: [!service { class: League\Flysystem\Local\LocalFilesystemAdapter, arguments: ['/etc/keys'] }]
        tags:
            - { name: 'key_management.flysystem', key: 'vault' }

A tag placed by hand wins: the storages of the bundle are only given one when they carry none.

Resources

• Documentation
• Contributing
• Report issues and send Pull Requests in the main Symfony repository