Building kms-viem-account-mini: a minimal AWS KMS signer for viem

Hi, I’m asuma, and I’m building blockchain × AI products at DaikoAI

As the title suggests, I recently built and released kms-viem-account-mini, a small library for signing with AWS KMS in viem with minimal dependencies.

[embed]GitHub - posaune0423/kms-viem-account-mini: Minimal AWS KMS-backed viem account for Ethereum… Minimal AWS KMS-backed viem account for Ethereum signing. - posaune0423/kms-viem-account-minigithub.com

Why I built it

When you search for viem + KMS related solutions, one of the first libraries you’ll find is cloud-cryptographic-wallet by odan. There is also a Zenn article explaining how to adapt it for viem:

[embed]ViemとKMSを利用したトランザクション署名 こんにちは！ no plan inc. にてエンジニアやってます @somasekiです。 これは no plan inc.の Advent Calendar 2023 の18日目の記事です。 今回は、…zenn.dev

That said, with the growing number of supply-chain attacks and dependency-related incidents, I wanted something more narrowly scoped: a lightweight, simple, and secure library dedicated specifically to viem + AWS KMS.

So I decided to build it myself.

Usage

The API is very straightforward. You create a KMS-backed viem-compatible Account with createKmsAccount(), then pass it into viem’s walletClient.

With only a few extra lines, you can turn an existing viem setup into a KMS-backed wallet client.

import { createKmsAccount } from "kms-viem-account-mini";
import { createWalletClient, http } from "viem";
import { sepolia } from "viem/chains";

const account = await createKmsAccount({
  keyId: process.env.AWS_KMS_KEY_ID!,
  region: "ap-northeast-1",
});

const walletClient = createWalletClient({
  account,
  chain: sepolia,
  transport: http("https://ethereum-sepolia-rpc.publicnode.com"),
});

const message = "hello from AWS KMS";
const signature = await walletClient.signMessage({
  account,
  message,
});

console.log({
  address: account.address,
  message,
  signature,
});

Implementation

This library is intentionally lightweight and depends on only two packages:

• viem
• @aws-sdk/client-kms

Compared to existing alternatives, its main characteristics are:

• focused only on AWS KMS + viem
• a minimal ASN.1 parser implemented directly in TypeScript for only the required cases
• compatible with both JSR and npm, with native Deno support

Focused only on AWS KMS + viem

Unlike more general-purpose libraries such as cloud-cryptographic-wallet, I intentionally dropped support for multiple cloud providers and other Ethereum client libraries like ethers.js or web3.js.

The goal was to optimize for a modern, specific use case and eliminate unnecessary dependencies wherever possible.

Implementing only the ASN.1 parsing we actually need

AWS KMS returns signatures as ASN.1 DER-encoded byte arrays.

Many existing libraries rely on packages such as asn1.js

to deserialize them. But in this case, the actual parsing requirements are very limited.

For the EVM signing flow with ECC_SECG_P256K1, the only DER structures we really need to handle are:

• the SubjectPublicKeyInfo DER returned by GetPublicKey
• the SEQUENCE(INTEGER r, INTEGER s) DER returned by Sign

In other words, the required flow is basically just:

1. fetch the public key
2. request a signature and parse the returned signature

That means a full ASN.1 implementation is unnecessary for this use case. So I implemented support only for these two specific cases:

• GetPublicKey → parse SubjectPublicKeyInfo
• Sign → parse SEQUENCE(INTEGER r, INTEGER s)

Relevant source files:

[embed]kms-viem-account-mini/src/lib/parse_kms_signature_der.ts at main ·… Minimal AWS KMS-backed viem account for Ethereum signing. - kms-viem-account-mini/src/lib/parse_kms_signature_der.ts at…github.com

[embed]kms-viem-account-mini/src/lib/parse_secp256k1_public_key_der.ts at main ·… Minimal AWS KMS-backed viem account for Ethereum signing. …github.com

JSR / npm compatible, with native Deno support

I also implemented the library using Deno.

A small but important detail is that I use minimumDependencyAge and nodeModulesDir: “none” to reduce the risk of unexpected installs or silent dependency version drift.

At runtime, Deno also lets you constrain the execution scope explicitly with flags such as — allow-env, which makes it easier to run scripts in a more controlled and secure way.

Closing thoughts

If you have any questions, feedback, or suggestions about the library, feel free to reach out on Zenn or X. Issues and PRs are also very welcome.

[embed]JavaScript is not available. Edit descriptionx.com

References

[embed]ViemとKMSを利用したトランザクション署名 こんにちは！ no plan inc. にてエンジニアやってます @somasekiです。 これは no plan inc.の Advent Calendar 2023 の18日目の記事です。 今回は、…zenn.dev

[embed]GitHub - odanado/cloud-cryptographic-wallet: cloud-cryptographic-wallet is a set of packages to… cloud-cryptographic-wallet is a set of packages to connect crypto libraries with key management systems of various…github.com

[embed]GitHub - jackchuma/viem-kms-signer: An AWS KMS compatible Viem signer An AWS KMS compatible Viem signer. Contribute to jackchuma/viem-kms-signer development by creating an account on…github.com