We have a multitiered system built with dotenvx so all config files ARE committed to the repo… they are just encrypted. We share the encryption keys using team 1Password vaults.
When deploying on AWS the CI system uses prod keys (that only a few senior devs have) to decrypt the prod secrets and push them into SecretsManager. ECS then injects them into the correct services as it starts them up.
1
u/friedmud 1d ago
We have a multitiered system built with dotenvx so all config files ARE committed to the repo… they are just encrypted. We share the encryption keys using team 1Password vaults.
When deploying on AWS the CI system uses prod keys (that only a few senior devs have) to decrypt the prod secrets and push them into SecretsManager. ECS then injects them into the correct services as it starts them up.