Documentation
¶
Overview ¶
Package awssm provides an AWS Secrets Manager provider.
Setting up the environment to run the application. There are two methods to set up the environment to run the application.
Flags (not recommended).
Values are set by specifying flags. In the following example, values are set and then the env command is run.
configurer l awssm \ --region "us-east-1" \ --secret-name "myapp/prod/secrets" \ --profile "default" -- env
Environment Variables (this is the recommended, and preferred way).
Setup values are set by specifying environment variables. In the following example, values are set and then the env command is run. It's cleaner and more secure.
export AWS_REGION="us-east-1" export AWS_PROFILE="default" export AWSSM_SECRET_NAME="myapp/prod/secrets" configurer l awssm -- env
Package awssm provides an AWS Secrets Manager provider for the configurer application.
The AWS Secrets Manager provider allows you to load secrets from AWS Secrets Manager and optionally write configuration data to AWS Secrets Manager. It supports both JSON and plain text secrets with various authentication methods.
Features ¶
- Load secrets from AWS Secrets Manager and export them as environment variables - Write configuration data to AWS Secrets Manager as JSON secrets - Support for both JSON and plain text secret formats - Multiple authentication methods (IAM roles, profiles, access keys) - Key transformation options (prefixing, suffixing, case conversion)
Authentication Methods ¶
The provider supports the following authentication methods:
- Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY)
- AWS credentials file (~/.aws/credentials)
- IAM roles (recommended for EC2/ECS/Lambda)
- AWS SSO
Environment Variables ¶
The following environment variables can be used to configure the provider:
- AWS_REGION: The AWS region where secrets are stored
- AWS_PROFILE: The AWS profile to use for authentication
- AWS_ACCESS_KEY_ID: The AWS access key ID (not recommended, use IAM roles instead)
- AWS_SECRET_ACCESS_KEY: The AWS secret access key (not recommended, use IAM roles instead)
- AWSSM_SECRET_NAME: The secret name to load from or write to AWS Secrets Manager
Usage Examples ¶
Loading secrets:
configurer l awssm -r us-east-1 -s myapp/prod/secrets -- env
Writing configuration:
configurer w --source dev.env awssm -r us-east-1 -n myapp/prod/secrets
Secret Formats ¶
For JSON secrets, each key-value pair will be exported as a separate environment variable. For plain text secrets, the secret name (last part after /) will be used as the environment variable name.
When writing secrets, all key-value pairs from the source file will be stored as a single JSON object in the specified secret.
Security Notes ¶
- It's recommended to use IAM roles for authentication instead of access keys - Already exported environment variables have precedence over loaded ones - Use the override flag to override existing environment variables
Index ¶
- Constants
- func New(override, rawValue bool, config *Config, secretInformation *SecretInformation) (provider.IProvider, error)
- func NewWithConfig(override, rawValue bool, config *Config, secretInformation *SecretInformation, ...) (provider.IProvider, error)
- type AWSSM
- type Config
- type SecretInformation
Constants ¶
const Name = "awssm"
Name of the provider.
Variables ¶
This section is empty.
Functions ¶
func New ¶
func New( override, rawValue bool, config *Config, secretInformation *SecretInformation, ) (provider.IProvider, error)
New creates a new AWS Secrets Manager provider. It'll pull secrets from AWS Secrets Manager, and then exports to the environment.
The following environment variables can be used to configure the provider:
- AWS_REGION: The AWS region where secrets are stored.
- AWS_PROFILE: The AWS profile to use for authentication.
- AWS_ACCESS_KEY_ID: The AWS access key ID (not recommended, use IAM roles instead).
- AWS_SECRET_ACCESS_KEY: The AWS secret access key (not recommended, use IAM roles instead).
- AWSSM_SECRET_NAME: Comma-separated list of secret names to load.
NOTE: It's recommended to use IAM roles for authentication instead of access keys.
NOTE: Already exported environment variables have precedence over loaded ones. Set the override flag to true to override them.
func NewWithConfig ¶
func NewWithConfig( override, rawValue bool, config *Config, secretInformation *SecretInformation, awsConfig aws.Config, ) (provider.IProvider, error)
NewWithConfig creates a new AWS Secrets Manager provider with custom AWS configuration.
Types ¶
type AWSSM ¶
type AWSSM struct {
*provider.Provider `json:"-" validate:"required"`
*Config `json:"-" validate:"required"`
*SecretInformation `json:"-" validate:"required"`
// contains filtered or unexported fields
}
AWSSM provider definition.
type Config ¶
type Config struct {
Region string `json:"region" validate:"omitempty,gte=1"`
Profile string `json:"profile" validate:"omitempty,gte=1"`
AccessKey string `json:"access_key" validate:"omitempty,gte=1"`
SecretKey string `json:"secret_key" validate:"omitempty,gte=1"`
}
Config contains AWS configuration settings.
type SecretInformation ¶
type SecretInformation struct {
SecretNames []string `json:"secret_names" validate:"required,gte=1"`
}
SecretInformation contains information about which secrets to retrieve.
Source Files