You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Where github-token / sentry-token are the actual keys in SSM and GITHUB_TOKEN / SENTRY_TOKEN are the keys referenced in the application to load from the secrets.json file. For example, in app the secret decryption would be done via:
Keep the existing dictionary structure for cases such as namespaced secrets e.g. my-amazing-project/a-namespace/my-secret
Describe alternatives you've considered
N/A
While we're making breaking changes, I'd also propose we rename environmentSecrets to ssmSecrets, again stripping off an artifact of the legacy environment variable implementation and making it clear that this is a direct ssm integration for secret loading.
The text was updated successfully, but these errors were encountered:
This is done. I created a draft release for 1.1.0. I'm going to just double check that we think enough testing has been done, then publish the release.
Is your feature request related to a problem? Please describe.
Currently secrets are referenced in serverless.yml as:
environmentSecrets:
GITHUB_TOKEN: github-token
SENTRY_TOKEN: sentry-token
Where github-token / sentry-token are the actual keys in SSM and GITHUB_TOKEN / SENTRY_TOKEN are the keys referenced in the application to load from the secrets.json file. For example, in app the secret decryption would be done via:
github_token = kms_decrypt("GITHUB_TOKEN")
sentry_token = kms_decrypt("SENTRY_TOKEN")
This indirection of introducing a separate identifier for the SSM key is confusing
Describe the solution you'd like
Optionally define the environmentSecrets as a simple list of the ssm-keys:
environmentSecrets:
- github-token
- sentry-token
And then reference them via the ssm key directly:
github_token = kms_decrypt("github-token")
sentry_token = kms_decrypt("sentry-token")
Keep the existing dictionary structure for cases such as namespaced secrets e.g.
my-amazing-project/a-namespace/my-secret
Describe alternatives you've considered
N/A
While we're making breaking changes, I'd also propose we rename environmentSecrets to ssmSecrets, again stripping off an artifact of the legacy environment variable implementation and making it clear that this is a direct ssm integration for secret loading.
The text was updated successfully, but these errors were encountered: