Module secrets 

Secret lookups in config placeholders.

A ${...} placeholder whose name has a : reads a secret store instead of the environment:

• ${aws-sm:<secret id or ARN>}: AWS Secrets Manager
• ${gcp-sm:<project>/<secret>[/<version>]}: GCP Secret Manager
• ${azure-kv:<vault>/<name>[/<version>]}: Azure Key Vault

A trailing #field reads one field of a JSON secret. Each store is served by its cloud’s add-on, like the cloud config sources.

Values are cached in memory for $SIGNAL_SECRETS_TTL_SECS (300 by default), since every store bills per read and the reloader polls every minute. They are never written to the config cache on disk.

Constants

STORES

The secret stores, as (scheme, display name).

TTL_ENV_VAR

Functions

is_ref

Whether a placeholder name (or a URL handed to an add-on) is a secret reference rather than an environment variable.