Skip to content

Environment secrets and variables

Summary

Separate your environment secrets from other typical environment variables. You can use AWS Secrets Manager and AWS Parameter Store to store environment secrets and variables. Storing values that belong together in the same place is common. For example, storing both a client_id and client_secret in the same location makes them easier to manage.

Environment secrets

Environment secrets are sensitive information that should not be stored in plain text. Examples of environment secrets include:

  • Database credentials
  • API keys
  • Environment specific secrets

Environment secrets are stored in AWS Secrets Manager. Create them in your Terraform configuration with the aws_secretsmanager_secret resource:

Example
resource "aws_secretsmanager_secret" "my_secret" {
  name = "my_secret"
}

Environment variables

Environment variables are non-sensitive information that is used to configure your application. Examples of environment variables include:

  • Database connection strings
  • API URLs
  • Environment specific configuration
  • Environment specific variables
  • Environment specific settings
  • Environment specific flags

Environment variables are stored in AWS Parameter Store. Create them in your Terraform configuration with the aws_ssm_parameter resource:

Example
resource "aws_ssm_parameter" "my_parameter" {
  name = "my_parameter"
  type = "String"
  value = "my_value"
  description = "My parameter"
}