Skip to main content
No secret is in the repository, in Terraform state, or in a build log. CI scans every commit for secrets.

Secrets Manager

The keys in oncoeverything/app: The API reads the secrets when a task starts.

Add or change a key in the app secret

1

Read the current secret and add the key

This keeps the keys already there.
2

Write it back

3

Delete the local file

Delete app-secret.json immediately.
4

Restart the API

Rotate the session key

Write a new random value. Then restart the API. After the restart, every user must sign in again.

Access without keys

  • People sign in to AWS through SSO. Nobody has an AWS access key.
  • GitHub Actions assumes a role through OIDC. The role can push API images, register task definitions, pass the API task its roles, and update the API service.
  • The API task has a role that can read its own secrets, send email and use its two buckets.