Getting Started

Install the package

TypeScript / JavaScript:

npm install cdk-sops-secrets

Python:

pip install cdk-sops-secrets

Java, .NET, Go: see the package repositories for the right coordinates.

Encrypt a secret with SOPS

Create a SOPS-encrypted file (JSON, YAML, dotenv or binary) and commit it to your repository as usual — the content stays encrypted at rest.

Add the construct to your stack

import { SopsSecret } from 'cdk-sops-secrets';
 
const secret = new SopsSecret(this, 'MySecret', {
  secretName: 'my-secret',
  sopsFilePath: 'secrets/encrypted-secret.json',
});

Deploy

On cdk deploy, the custom resource decrypts the file and writes its content into the AWS Secrets Manager secret named my-secret. Required IAM permissions are derived automatically — nothing else to configure.

That covers the most common case. For SSM Parameter Store instead of Secrets Manager, or for fine-grained control over the sync Lambda, see Available Constructs.