Env Secrets Manager

The system: .env.example is the contract. Any env var referenced in code must be in .env.example. Drift = CI failure.

Step 1: Generate .env.example from codebase

# Scanner extracts all process.env.FOO references from code
python scripts/env_scanner.py --repo . --extract-vars --output .env.example

# .env.example — committed to git, no real values
DATABASE_URL=postgresql://localhost:5432/myapp_dev
JWT_SECRET=change-me-in-each-environment
STRIPE_PUBLIC_KEY=pk_test_...
STRIPE_SECRET_KEY=sk_test_...  # NEVER commit real sk_live_ values
LOG_LEVEL=info
# OPTIONAL_FEATURE_FLAG=false

Step 2: CI drift check

# .github/workflows/ci.yml
- name: Env drift check
  run: |
    python scripts/env_scanner.py \
      --check-drift \
      --required .env.example \
      --actual .env.ci
  # Fails CI if .env.ci is missing any var from .env.example

Step 3: New developer onboarding (30 seconds)

# setup.sh
cp .env.example .env.local
echo "Fill in your personal values — get secrets from 1Password vault: Engineering/Dev Secrets"

Result: every developer has .env.local pre-populated with all keys, knows exactly which values to get from the password manager, and CI catches any new var that's added to code but not documented in .env.example.

This skill includes executable scripts — I'll need your permission before running them.

Phase 1: Upload existing vars to Secrets Manager (day 1)

python scripts/env_scanner.py \
  --migrate-to-aws \
  --input .env.production \
  --secret-name myapp/production \
  --region us-east-1

This creates one JSON secret per service:

// Secret: myapp/production
{
  "DATABASE_URL": "postgresql://...",
  "JWT_SECRET": "...",
  "STRIPE_SECRET_KEY": "sk_live_..."
}

Phase 2: Update app to read from Secrets Manager (day 2-3)

# config.py — replaces python-dotenv loading
import boto3, json, functools

@functools.lru_cache(maxsize=1)  # cache for process lifetime
def get_secrets() -> dict:
    client = boto3.client('secretsmanager', region_name='us-east-1')
    response = client.get_secret_value(SecretId='myapp/production')
    return json.loads(response['SecretString'])

_s = get_secrets()
DATABASE_URL = _s['DATABASE_URL']
STRIPE_SECRET_KEY = _s['STRIPE_SECRET_KEY']

Phase 3: IAM least-privilege policy

{
  "Effect": "Allow",
  "Action": ["secretsmanager:GetSecretValue"],
  "Resource": "arn:aws:secretsmanager:us-east-1:*:secret:myapp/*"
}

Phase 4: Enable rotation (day 4)

aws secretsmanager rotate-secret \
  --secret-id myapp/production \
  --rotation-rules AutomaticallyAfterDays=90

Cost: ~$0.40/secret/month = ~$1.20/month for 3 services. Far cheaper than a credential rotation incident.