Using AWS and segment.io/chamber CLI for managing secrets for your projects
CLI for managing secrets. Contribute to segmentio/chamber development by creating an account on GitHub.
There is a lot of ways of storing per project secrets, such as paswords, tokens, private api urls, etc.
One can use local not to be commited files,. bashrc env vars, other hosted services such as Hashicorp vault, etc.
But if you want to share a your code with others including secrets you need some universal solution anyone can use.
- KMS key — $1/month + $0.03 per 10,000 requests
- SSM Parameter store — free
# Download chamber and build it locally
> go get github.com/segmentio/chamber
# Put alias to chamber executable into bashrc
> echo "alias chamber=$GOPATH/bin/chamber" | tee -a ~/.bashrc && source ~/.bashrc
> chamber version
Pro-tip: Using right IAM access token and creating all parameter values by UI you can skip on creating KMS key (thus not paying $1 month). Enter all secure values using alias/aws/ssm key.
SSM Parameter store
Format for name of variables is /<service-name>/ENV_NAME
When you run chamber you specify a service name:
> chamber exec azure/test1 — sh -c set | grep SQL
variables are taken from AWS Systems Manager -> Parameter store
You can write new key/value pairs using Web UI or using chamber CLI
> chamber write azure/test1 NAME VALUE
Pass chamber when running a command
Embed chamber into any command by prefixing it with chamber exec
> chamber exec <service-name> -- my-awesome-build-or-deploy-command
All variables will be available un environment as $SQL_HELLO variables.
For example, if you want to define serverless.com deploy command, you can do it this way:
"deploy": "chamber exec azure/test1 -- npx serverless deploy"
}> yarn run deploy
When running for production, use AWS_PROFILE, AWS_REGION or aws-vault command to use different AWS account/role to access AWS SSM Parameter store.
My Azure FaaS test project uses chamber to conveniently store and access SQL database credentials