How to match different fields and use different keys in .sops.yaml

[NicolasGuary]

Hello !
I have a YAML file containing values for different envs (let's say dev and prod).
I have a prod block and a dev that I want to encrypt with SOPS using different KMS keys, and I'm struggling to implement the correct rule in a .sops.yaml and I don't even know if it's possible.

The problem is that in the file, something like this won't work, because SOPS will only evaluate the first matching block :

creation_rules:
  - path_regex: .*/config.yml
    encrypted_regex: PROD_REGEX
    gcp_kms: path_to_prod_key
  - path_regex: .*/config.yml
    encrypted_regex: DEV_REGEX
    gcp_kms: path_to_dev_key

And, I did not find a way to specify multiple regex and keys in the same block, is this possible ?

Thank you !

[NicolasGuary]

And the underlying question might be : is it even possible to encrypt different fields from a YAML file using different KMS keys?

[felixfontein]

It is not. Also the fields aren't encrypted by a KMS key, but by a per-file randomly generated key. That key is in turn encrypted by the KMS keys and stored in that file. The same per-file key is used for all fields in that file.

[NicolasGuary]

Thank you for your reply, I’ll change my approach with my use-case then !
Also, thank you for the clarification on how SOPS works, appreciated!