Available Constructs

Assume you want to store this data in AWS:

{
  "apiKey": "sk-1234567890abcdef",
  "database": {
    "user": "admin",
    "password": "P@ssw0rd!",
    "host": "db.example.com"
  },
  "tokens": [
    { "service": "github", "token": "ghp_abcd1234" },
    { "service": "aws", "token": "AKIAIOSFODNN7EXAMPLE" }
  ],
  "someOtherKey": "base64:VGhpcyBpcyBhIHNlY3JldCBrZXk="
}

It doesn't matter whether the file is json, yaml or dotenv — cdk-sops-secrets handles all three, and binary data is supported with some limitations.

SopsSecret

Sync a SOPS file into an AWS Secrets Manager secret

SopsStringParameter

Sync a whole SOPS file into a single SSM Parameter

MultiStringParameter

Fan a structured SOPS file out into many SSM Parameters

SopsSyncProvider

The custom-resource Lambda that does the actual decrypt-and-sync work

Age Key from SSM Parameter Store

Keep the SOPS age private key out of the Lambda's plaintext config

Common configuration options

Options shared by all three secret/parameter constructs