Introduction

What problem does it solve?#

Encrypts secrets at rest using SOPS before you commit them to Git
Automatically syncs the decrypted content to AWS Secrets Manager and SSM Parameter Store during deployment
Simplifies secret management with easy-to-use CDK constructs that derive IAM permissions for you

Features#

Multi-format support

JSON, YAML, dotenv and binary SOPS files all work out of the box

Secrets Manager sync

Create AWS Secrets Manager secrets straight from an encrypted SOPS file

SSM Parameter sync

Sync one file into a single Parameter, or fan it out into many

Least-privilege IAM

Required permissions are derived automatically from your input

Getting started#

Ready to add it to a stack? Head to Getting Started for installation and a minimal example, or jump straight to Available Constructs for the full API.

Contributing#

We welcome contributions.

Bug reports and feature requests: open an issue
Security vulnerabilities: see the Security Policy
Code contributions: see CONTRIBUTING.md in the repository
Questions: open a discussion

This site documents dbsystel/cdk-sops-secrets on GitHub — the source of truth for code and issues stays there.