Skip to content

Environment secrets and variables

Summary

Separate your environment secrets from other typical environment variables. You can use AWS Secrets Manager and AWS Parameter Store to store environment secrets and variables. Storing values that belong together in the same place is common. For example, storing both a client_id and client_secret in the same location makes them easier to manage.

Environment secrets

Environment secrets are sensitive information that should not be stored in plain text. Examples of environment secrets include:

  • Database credentials
  • API keys
  • Environment specific secrets

Environment secrets are stored in AWS Secrets Manager. You can refer to these in your Terraform configuration using the aws_secretsmanager_secret_version resource. This resource automatically fetches the secret value from AWS Secrets Manager. The secret is stored in the secret_string attribute.

Example
resource "aws_secretsmanager_secret" "my_secret" {
  name = "my_secret"
}

Environment variables

Environment variables are non-sensitive information that is used to configure your application. Examples of environment variables include:

  • Database connection strings
  • API URLs
  • Environment specific configuration
  • Environment specific variables
  • Environment specific settings
  • Environment specific flags

Environment variables are stored in AWS Parameter Store. They are referenced in your Terraform configuration using the aws_ssm_parameter resource. This resource automatically fetches the parameter value from AWS Parameter Store. The variable is stored in the value attribute.

Example
resource "aws_ssm_parameter" "my_parameter" {
  name = "my_parameter"
  type = "String"
  value = "my_value"
  description = "My parameter"
}