https://github.com/serverless/serverless-secrets-plugin
https://github.com/serverless/serverless-secrets-plugin
Last synced: 6 months ago
JSON representation
- Host: GitHub
- URL: https://github.com/serverless/serverless-secrets-plugin
- Owner: serverless
- License: mit
- Created: 2016-11-24T16:58:15.000Z (over 8 years ago)
- Default Branch: master
- Last Pushed: 2019-09-06T04:07:42.000Z (almost 6 years ago)
- Last Synced: 2024-12-11T13:52:13.287Z (6 months ago)
- Language: JavaScript
- Size: 12.7 KB
- Stars: 66
- Watchers: 28
- Forks: 16
- Open Issues: 5
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- License: LICENSE
Awesome Lists containing this project
README
# Serverless Credentials Plugin
IMPORTANT NOTE: As pointed out in the [AWS documentation](http://docs.aws.amazon.com/lambda/latest/dg/env_variables.html) for storing sensible information Amazon recommends to use AWS KMS instead of environment variables like this plugin.
[](http://www.serverless.com)
[](https://badge.fury.io/js/serverless-secrets-plugin)
[](https://www.npmjs.com/package/serverless-secrets-plugin)
# Install
```bash
npm install --save-dev serverless-secrets-plugin
```
After that you need to add the plugin to your `serverless.yml` of you service.
Run the command `serverless --help` and verify the list of commands contain an `encrypt` and a `decrypt` command.
# Usage
Create a `secrets.{stage}.yml` file for each stage e.g. `secrets.dev.yml`.
Store the keys in there, that you want to keep private e.g.
```yml
EMAIL_SERVICE_API_KEY: DEV_API_EXAMPLE_KEY_12
SESSION_KEY: DEV_SESSION_EXAMPLE_KEY_12
```
You can also provide a path prefix if you like to keep your secrets in a different directory e.g.
```yml
custom:
secretsFilePathPrefix: config
```
Encrypt the secrets file for the desired stage by running
```bash
serverless encrypt --stage dev --password '{your super secure password}'
```
This will result in an encrypted file e.g. `secrets.dev.yml.encrypted`. You can check the encrypted file into your version control system e.g. Git. It's recommened to add your unencrypted file to `.gitignore` or similar so you and your colleagues can't check it in by accident.
In your `serverless.yaml` you can use the file variable syntax to import the secrets and set them as environment variables. When you create or update Lambda functions that use environment variables, AWS Lambda encrypts them using the AWS Key Management Service. Read more about that in the AWS documentation [here](http://docs.aws.amazon.com/lambda/latest/dg/env_variables.html).
Whenever you want to deploy there needs to be the unencrypted version of the secrets file available otherwise the plugin will prevent the deployment.
# Example
You can check out a full example in the Serverless Examples repository: [serverless/examples/aws-node-env-variables-encrypted-in-a-file](https://github.com/serverless/examples/tree/master/aws-node-env-variables-encrypted-in-a-file).