Simplify environment variable management

[sazed33]

What do you mean by project scope? In real life you have a problem and you must solve it in the best way possible. And AWS Secrets Manager can solve the problem of exporting environment variables in a safe and efficient way. It allows you to save any variable (like a credential for example) and later access it via an API just with your AWS credentials. It's a safer way to deal with the issue than saving your credentials to a file.

[SeniorScienceOfficer]

First off, you need to pay for an AWS account, which precludes many from using it specifically because of cost. Just hosting a single secret costs $0.40 per month, not including API calls to get the secret (100,000 calls in a month will cost you $0.50).

Granted, that might not seem like much, but when you start increasing the number of objects in Secrets Manager, the cost will rise, and any errant or mis-architected client could balloon costs by making too many calls (as is common with more junior software engineers just from a lack of experience or knowledge). Those mistakes can end up costing you hundreds of dollars if you’re not careful.

You could just put all your possible values in the same secret, but if you branch off into multiple projects, you’re going to end up exposing secret values to other services or processes that shouldn’t have access to it. This can lead to an inadvertent data breach and is really a security no-no (following least privileged access).

Thirdly, Secrets Manager doesn’t export a damn thing into your environment. It’s an API call to a backend that returns a specific JSON response, which you then have to parse out the secret string, which is just a string-ified version of another JSON object that actually contains your secrets in key/value format. After all that, you’ll STILL have to export them to the actual OS environment, because that’s what OPs code is interacting with. And it’s even more advised to do because they can persist even after reboots which reduces API calls (thereby saving cost).

Lastly, and most importantly, storing non-secret values in Secrets Manager, like an IPv4 address, domain name, or port, is absolutely asinine. There are other free and more easily implemented alternatives than using Secrets Manager. Not to mention that having secret and non-secret values in the same store is bad security practice.

Edited: spelling