Platforms
Envlet on AWS
Lambda, ECS, and EC2 all take one environment variable. ENVLET_TOKEN replaces every other secret you were copying into task definitions.
ENVLET_TOKENset with aws
Set up
Three steps. The host keeps one secret and everything else arrives at boot.
- 01
Create a token
Add AWS under Access and create a token for the environment it deploys.
ci/awsciIts own token, separate from your login.- token
- envlet_•••••••• shown once
- opens
- one project, one environment
- expires
- always
- 02
Set one secret
Set ENVLET_TOKEN in the Lambda configuration, the ECS task definition, or the instance user data.
Set the tokenaws lambda update-function-configuration \ --function-name api \ --environment "Variables={ENVLET_TOKEN=envlet_...}" - 03
Start through Envlet
Inject at module load. One fetch per cold start.
Inject on cold startfrom envlet import inject inject() def handler(event, context): ...
What the host keeps
One secret in AWS. Rotate everything else in Envlet without touching the host.
AWS / production / environment variables
| ENVLET_TOKEN | envlet_•••••••• | the only secret the host keeps |
| DATABASE_URL | •••••••• | moved to Envlet |
| STRIPE_KEY | •••••••• | moved to Envlet |
| SENTRY_DSN | •••••••• | moved to Envlet |
Questions
Will my app start if Envlet is down?
No. It retries for a few seconds, then fails so you notice. It never starts with half an environment.
Do I still need AWS's own secret store?
Only for ENVLET_TOKEN. Everything else lives in Envlet, so you rotate in one place.