Envlet
Start free
Guides

Move from AWS Secrets Manager to Envlet

Keep AWS for the one token if policy requires it, and stop writing IAM policies for every secret your app reads.

About 20 minutes

  1. 01

    Sign in once

    Install the CLI and sign in. It shows a URL and a code; approve in the browser and you are in.

    Terminal
    npm install -g @envlet/cli
envlet login
  2. 02

    Decide what stays in AWS

    Only ENVLET_TOKEN needs to reach the runtime. Put it in the Lambda configuration or the task definition, or keep that one value in Secrets Manager if policy says so. Everything else moves to Envlet.

  3. 03

    Import the values

    Export each secret from Secrets Manager into a local .env file, then import it with the MCP server or set each one with envlet set.

    Terminal
    aws secretsmanager get-secret-value --secret-id prod/api --query SecretString --output text > .env.production
# then import .env.production with the MCP server or envlet set
  4. 04

    Inject on cold start

    Call inject() at module load. A cold start fetches once; warm invocations reuse it.

    handler.py
    from envlet import inject

inject()

def handler(event, context):
    ...
  5. 05

    Retire the IAM policies

    Once the function reads from Envlet, the per-secret IAM statements can go.

Related

Stop pasting .env files.

One command. The right values for whoever runs it.

Start free