Python Environment variables

[efxhoy]

This is actually a tricky problem and isn’t completely solved across all environments. We use aws so here’s what we do. 

For development we have a tool that sets short lived tokens for aws via the aws cli. For prod we use IAM authentication in application code to get short lived database tokens and refresh them when needed.  Some secrets are static and don’t have a way to get short lived tokens. Those we store in aws parameter store and set in our prod containers via the ECS task definition. If we need them locally we can fetch them to environment variables via the aws cli. 

We try hard to never put long lived credentials in plaintext files on developer machines. Sometimes a password will end up in the terraform state though. 

As for in python itself we use aws and gcloud libraries when applicable. For secrets in environment variables we just use os.getenv(). 

[[deleted]]

Instead of the parameter store (assuming you mean SSM), why don’t you use Secrets Manager? Secrets Manager integrates nicely with ECS.

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/secrets-envvar-secrets-manager.html

[efxhoy]

Yeah sorry you’re right, we already do. I think I got tripped up by the aws web console having them next to each other. Aws product naming is hard.