Move from AWS Secrets Manager to Envlet

1. 01

   Sign in once

   Install the CLI and sign in. It shows a URL and a code; approve in the browser and you are in.

   Terminal

   npm install -g @envlet/cli
   envlet login

2. 02

   Decide what stays in AWS

   Only ENVLET_TOKEN needs to reach the runtime. Put it in the Lambda configuration or the task definition. Everything else moves to Envlet.

3. 03

   Import the values

   Export each secret from Secrets Manager into a local .env file, then import it with the MCP server or set each one with envlet set.

   Terminal

   aws secretsmanager get-secret-value --secret-id prod/api --query SecretString --output text > .env.production
   # then import .env.production with the MCP server or envlet set

4. 04

   Inject on cold start

   Call inject() at module load. A cold start fetches once; warm invocations reuse it.

   handler.py

   from envlet import inject
   
   inject()
   
   def handler(event, context):
       ...

5. 05

   Retire the IAM policies

   Once the function reads from Envlet, the per-secret IAM statements can go.

Related

• AWS
• Python SDK