Cloud Kms

DevOps & Security

cloud-kms

Cloud Kms is an Agent Skill for devops & security published in the Nethereum/Nethereum repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Sign Ethereum transactions with AWS KMS or Azure Key Vault HSMs using Nethereum. Use this skill whenever the user asks about AWS KMS Ethereum signing, Azure Key Vault signing, cloud HSM, managed key signing, serverless wallet, key management service, or cloud-based transaction signing in C#/.NET.

View on GitHub ↗

QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

Open your project in Codex.
Copy and paste the prompt below.
Review files and risks before approving any action.

Prompt to paste

Inspect the Agent Skill at https://github.com/Nethereum/Nethereum/blob/HEAD/plugins/nethereum-skills/skills/cloud-kms/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cloud-kms, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

Cloud KMS Signing with Nethereum

Private key generated inside HSM, never exported. Both support Legacy, EIP-1559, EIP-2930, and EIP-7702 transactions.

AWS KMS

NuGet: Nethereum.Signer.AWSKeyManagement

dotnet add package Nethereum.Signer.AWSKeyManagement

Create Key

aws kms create-key --key-spec ECC_SECG_P256K1 --key-usage SIGN_VERIFY

Sign Transactions

using Nethereum.Signer.AWSKeyManagement;
using Nethereum.Web3;
using Nethereum.Web3.Accounts;

// Uses default AWS credentials chain
var signer = new AWSKeyManagementExternalSigner(keyId: "your-kms-key-id");

var externalAccount = new ExternalAccount(signer, chainId: 1);
await externalAccount.InitialiseAsync();

var web3 = new Web3(externalAccount, "https://your-rpc-url");

var receipt = await web3.Eth.GetEtherTransferService()
    .TransferEtherAndWaitForReceiptAsync(toAddress, 0.1m);

Auth Methods

// Default credentials (Lambda, ECS, EC2)
var signer = new AWSKeyManagementExternalSigner(keyId);

// Explicit credentials
var signer = new AWSKeyManagementExternalSigner(
    keyId, accessKeyId: "AKIA...", secretAccessKey: "...");

// Specific region
var signer = new AWSKeyManagementExternalSigner(
    keyId, region: Amazon.RegionEndpoint.EUWest1);

Azure Key Vault

NuGet: Nethereum.Signer.AzureKeyVault

dotnet add package Nethereum.Signer.AzureKeyVault

Create Key

az keyvault key create --vault-name my-vault --name ethereum-key --kty EC --curve SECP256K1

Sign Transactions

using Nethereum.Signer.AzureKeyVault;
using Nethereum.Web3;
using Nethereum.Web3.Accounts;
using Azure.Identity;

var signer = new AzureKeyVaultExternalSigner(
    keyIdentifier: "https://my-vault.vault.azure.net/keys/ethereum-key");

var externalAccount = new ExternalAccount(signer, chainId: 1);
await externalAccount.InitialiseAsync();

var web3 = new Web3(externalAccount, "https://your-rpc-url");

var receipt = await web3.Eth.GetEtherTransferService()
    .TransferEtherAndWaitForReceiptAsync(toAddress, 0.1m);

Auth Methods

// DefaultAzureCredential (auto-detect)
var signer = new AzureKeyVaultExternalSigner(keyIdentifier);

// Managed identity
var signer = new AzureKeyVaultExternalSigner(
    keyIdentifier, new ManagedIdentityCredential());

// Service principal
var signer = new AzureKeyVaultExternalSigner(
    keyIdentifier, new ClientSecretCredential(tenantId, clientId, clientSecret));

For full documentation, see: https://docs.nethereum.com/docs/signing-and-key-management/guide-cloud-kms