Using AWS and segment.io/chamber CLI for managing secrets for your projects

Introduction

One can use local not to be commited files,. bashrc env vars, other hosted services such as Hashicorp vault, etc.

But if you want to share a your code with others including secrets you need some universal solution anyone can use.

Pricing (2019–01–24)

  1. SSM Parameter store — free

Install chamber

# Download chamber and build it locally
> go get github.com/segmentio/chamber
# Put alias to chamber executable into bashrc
> echo "alias chamber=$GOPATH/bin/chamber" | tee -a ~/.bashrc && source ~/.bashrc
> chamber version
chamber dev

KMS key

Pro-tip: Using right IAM access token and creating all parameter values by UI you can skip on creating KMS key (thus not paying $1 month). Enter all secure values using alias/aws/ssm key.

SSM Parameter store

When you run chamber you specify a service name:

> chamber exec azure/test1 — sh -c set | grep SQL
SQL_HELLO='....'
SQL_USER='....'
SQL_X='.....'

variables are taken from AWS Systems Manager -> Parameter store

You can write new key/value pairs using Web UI or using chamber CLI

> chamber write azure/test1 NAME VALUE

Pass chamber when running a command

> chamber exec <service-name> -- my-awesome-build-or-deploy-command

All variables will be available un environment as $SQL_HELLO variables.

For example, if you want to define serverless.com deploy command, you can do it this way:

# package.json:
"scripts": {
"deploy": "chamber exec azure/test1 -- npx serverless deploy"
}
> yarn run deploy

Production

Example usage

Tech Lead & Software engineer with a passion for #DevRel, Serverless, Java, and Javascript. https://ruslan.org

Tech Lead & Software engineer with a passion for #DevRel, Serverless, Java, and Javascript. https://ruslan.org