@openchair-io/secrets-manager

Simple CLI to sync secrets between AWS Secrets Manager and .env files. Pull secrets from AWS Secrets Manager and output them into .env format, or sync .env files to AWS Secrets Manager for AWS Secrets Manager type: Other type of secret.

Install

We recommend that you install it at the global npm level so that you can use it wherever, but obviously feel free to install it at the package level.

npm i -g @openchair-io/secrets-manager

Usage

See available options and what they do.

oc secrets --help

Fetch secrets and output to ./.env.

export AWS_ACCESS_KEY_ID=xxxx
export AWS_SECRET_ACCESS_KEY=xxx

oc secrets <aws secrets manager secret name>

This will create a .env file in the directory you run it in that looks like:

SECRET_1=xxxx
SECRET_2=xxxx

Fetch secrets and output to a different path i.e. ./.env.development.

export AWS_ACCESS_KEY_ID=xxxx
export AWS_SECRET_ACCESS_KEY=xxx

oc secrets <aws secrets manager secret name> --path .env.development

This will create an env file at ./.env.development file that looks like:

SECRET_1=xxxx
SECRET_2=xxxx

Fetch secrets and output to a different path i.e. ~/desktop/.env.development .

export AWS_ACCESS_KEY_ID=xxxx
export AWS_SECRET_ACCESS_KEY=xxx

oc secrets <aws secrets manager secret name> --path .env.development

This will create an env file at ~/desktop/.env.development file that looks like:

SECRET_1=xxxx
SECRET_2=xxxx

Fetch secrets and prepend export.

export AWS_ACCESS_KEY_ID=xxxx
export AWS_SECRET_ACCESS_KEY=xxx

oc secrets <aws secrets manager secret name> --prepend 'export '

This will create an env file at ./.env file that looks like:

export SECRET_1=xxxx
export SECRET_2=xxxx

Sync .env to AWS Secrets Manager (sync command)

⚠️ Important: The sync command completely replaces all secrets in AWS Secrets Manager with the contents of your .env file. Any existing secrets not in your .env file will be removed.

Sync ./.env to AWS Secrets Manager:

export AWS_ACCESS_KEY_ID=xxxx
export AWS_SECRET_ACCESS_KEY=xxx

oc sync <aws secrets manager secret name>

Sync from a different .env file:

oc sync <aws secrets manager secret name> --path .env.production

Create the secret if it doesn't exist:

oc sync <aws secrets manager secret name> --create

Use a different AWS region:

oc sync <aws secrets manager secret name> --region us-west-2

Combine options:

oc sync <aws secrets manager secret name> --path .env.staging --region us-west-2 --create