Using AWS and segment.io/chamber CLI for managing secrets for your projects

Introduction

There is a lot of ways of storing per project secrets, such as paswords, tokens, private api urls, etc.

One can use local not to be commited files,. bashrc env vars, other hosted services such as Hashicorp vault, etc.

But if you want to share a your code with others including secrets you need some universal solution anyone can use.

Pricing (2019–01–24)

  1. KMS key — $1/month + $0.03 per 10,000 requests
  2. SSM Parameter store — free

Install chamber

KMS key

Create KMS key called parameter_store_key or make alias named parameter_store_key to your existing KMS key.

Pro-tip: Using right IAM access token and creating all parameter values by UI you can skip on creating KMS key (thus not paying $1 month). Enter all secure values using alias/aws/ssm key.

SSM Parameter store

Format for name of variables is /<service-name>/ENV_NAME

When you run chamber you specify a service name:

variables are taken from AWS Systems Manager -> Parameter store

Image for post
Image for post

You can write new key/value pairs using Web UI or using chamber CLI

Pass chamber when running a command

Embed chamber into any command by prefixing it with chamber exec

All variables will be available un environment as $SQL_HELLO variables.

For example, if you want to define serverless.com deploy command, you can do it this way:

Production

When running for production, use AWS_PROFILE, AWS_REGION or aws-vault command to use different AWS account/role to access AWS SSM Parameter store.

Example usage

My Azure FaaS test project uses chamber to conveniently store and access SQL database credentials

Written by

Tech Lead & Software engineer with a passion for #DevRel, Serverless, Java, and Javascript. https://ruslan.org

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store