Skip to content

vault-sync-README.md

Latest commit

 

History

History
99 lines (67 loc) · 1.8 KB

vault-sync-README.md

File metadata and controls

99 lines (67 loc) · 1.8 KB

vault-sync

Syncs environment variables between AWS Parameter Store and your deployment platforms. Built this after mass spending a Friday night debugging why production had old database creds.

What it does

You have one source of truth (AWS Parameter Store), this pushes to everywhere else:

AWS Parameter Store → Vercel, Heroku, Railway, local .env

Install

npm install -g vault-sync

Setup

vault-sync init

This creates .vault-sync.yaml. Edit it:

source:
  type: aws
  region: us-east-1
  prefix: /myapp/prod/

targets:
  - type: vercel
    project: my-frontend
    
  - type: heroku
    app: my-backend
    
  - type: local
    path: .env

Usage

Push to all targets:

vault-sync push
Syncing from AWS Parameter Store...
  ✓ Vercel (production)    4 updated
  ✓ Heroku (myapp)         4 updated
  ✓ .env                   4 updated
Done.

Check what's out of sync without changing anything:

vault-sync diff

Pull from source to local .env only:

vault-sync pull

Options

vault-sync push --dry-run          # preview changes
vault-sync push --env staging      # specific environment  
vault-sync push --filter "DB_*"    # only matching vars

Supported platforms

Sources: AWS Parameter Store, AWS Secrets Manager, HashiCorp Vault, 1Password

Targets: Vercel, Heroku, Railway, Netlify, Fly.io, local .env

Notes

  • Needs AWS credentials configured (aws configure or env vars)
  • Vercel/Heroku need their CLI tools installed and logged in
  • Doesn't store secrets anywhere - streams directly between services

Known issues

  • Fly.io target is slow (~5s per variable) because their API doesn't support batch updates
  • Railway target doesn't work with team projects yet, only personal

License

MIT