Using AWS and segment.io/chamber CLI for managing secrets for your projects
Introduction
There is a lot of ways of storing per project secrets, such as paswords, tokens, private api urls, etc.
One can use local not to be commited files,. bashrc env vars, other hosted services such as Hashicorp vault, etc.
But if you want to share a your code with others including secrets you need some universal solution anyone can use.
Pricing (2019–01–24)
- KMS key — $1/month + $0.03 per 10,000 requests
- SSM Parameter store — free
Install chamber
# Download chamber and build it locally
> go get github.com/segmentio/chamber
# Put alias to chamber executable into bashrc
> echo "alias chamber=$GOPATH/bin/chamber" | tee -a ~/.bashrc && source ~/.bashrc
> chamber version
chamber dev
KMS key
Create KMS key called parameter_store_key or make alias named parameter_store_key to your existing KMS key.
Pro-tip: Using right IAM access token and creating all parameter values by UI you can skip on creating KMS key (thus not paying $1 month). Enter all secure values using alias/aws/ssm key.
SSM Parameter store
Format for name of variables is /<service-name>/ENV_NAME
When you run chamber you specify a service name:
> chamber exec azure/test1 — sh -c set | grep SQL
SQL_HELLO='....'
SQL_USER='....'
SQL_X='.....'
variables are taken from AWS Systems Manager -> Parameter store
You can write new key/value pairs using Web UI or using chamber CLI
> chamber write azure/test1 NAME VALUE
Pass chamber when running a command
Embed chamber into any command by prefixing it with chamber exec
> chamber exec <service-name> -- my-awesome-build-or-deploy-command
All variables will be available un environment as $SQL_HELLO variables.
For example, if you want to define serverless.com deploy command, you can do it this way:
# package.json:
"scripts": {
"deploy": "chamber exec azure/test1 -- npx serverless deploy"
}> yarn run deploy
Production
When running for production, use AWS_PROFILE, AWS_REGION or aws-vault command to use different AWS account/role to access AWS SSM Parameter store.
Example usage
My Azure FaaS test project uses chamber to conveniently store and access SQL database credentials