Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

reference environment secrets directly by their ssm name #1

Closed
cruisercohen opened this issue Aug 15, 2019 · 1 comment
Closed

reference environment secrets directly by their ssm name #1

cruisercohen opened this issue Aug 15, 2019 · 1 comment

Comments

@cruisercohen
Copy link
Contributor

Is your feature request related to a problem? Please describe.
Currently secrets are referenced in serverless.yml as:

environmentSecrets:
GITHUB_TOKEN: github-token
SENTRY_TOKEN: sentry-token

Where github-token / sentry-token are the actual keys in SSM and GITHUB_TOKEN / SENTRY_TOKEN are the keys referenced in the application to load from the secrets.json file. For example, in app the secret decryption would be done via:

github_token = kms_decrypt("GITHUB_TOKEN")
sentry_token = kms_decrypt("SENTRY_TOKEN")

This indirection of introducing a separate identifier for the SSM key is confusing

Describe the solution you'd like
Optionally define the environmentSecrets as a simple list of the ssm-keys:

environmentSecrets:
- github-token
- sentry-token

And then reference them via the ssm key directly:

github_token = kms_decrypt("github-token")
sentry_token = kms_decrypt("sentry-token")

Keep the existing dictionary structure for cases such as namespaced secrets e.g. my-amazing-project/a-namespace/my-secret

Describe alternatives you've considered
N/A

While we're making breaking changes, I'd also propose we rename environmentSecrets to ssmSecrets, again stripping off an artifact of the legacy environment variable implementation and making it clear that this is a direct ssm integration for secret loading.

@mccredie
Copy link
Contributor

This is done. I created a draft release for 1.1.0. I'm going to just double check that we think enough testing has been done, then publish the release.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

2 participants