{"schemaVersion":"1.0","type":"TechArticle","types":["Article","TechArticle"],"slug":"from-chaos-to-consistency-how-we-centralized-secrets-with-aws-ssm-and-a-simple-cli-wlt9o","url":"https://zyvop.com/from-chaos-to-consistency-how-we-centralized-secrets-with-aws-ssm-and-a-simple-cli-wlt9o","title":"From chaos to consistency: how we centralized secrets with AWS SSM and a simple CLI","subtitle":null,"tldr":"At M47, security is one of our concerns across all our AI and cloud-native projects. That’s why we...","keywords":["AWS","opensource","DevOps","cli"],"entities":["Marçal Albert Castellví","Principal Software Engineer","AWS","opensource","DevOps","cli","ZyVOP"],"keyTakeaways":["At M47, security is one of our concerns across all our AI and cloud-native projects.","That’s why we store all sensitive configurations in a secure and centralized place like the AWS SSM Parameter Store.","While our repositories are private, that’s not enough."],"headings":["💡 What does it do?","🧩 Example","👥 Why it helps teams","✅ Features","📦 Install","🙌 I’d love your feedback"],"outboundLinks":["https://m47labs.com/","https://github.com/macalbert/envilder","https://dev.to/macalbert/one-year-of-envilder-from-a-cli-script-to-sdks-push-mode-and-a-website-h49"],"contentText":"At M47, security is one of our concerns across all our AI and cloud-native projects. That’s why we store all sensitive configurations in a secure and centralized place like the AWS SSM Parameter Store. While our repositories are private, that’s not enough. Secrets don’t belong in code. We deliberately use Parameter Store over Secrets Manager because our needs don’t require secret rotation or tight lifecycle policies, and SSM gives us all the flexibility and control we need for storing tokens, API keys, and service credentials. But then comes the friction: Every time we onboard someone, clone a project, create/update a new CD pipeline, or adjust a Dockerfile, we have to manually fetch and sync secrets. This leads to overhead, mistakes, and inconsistencies between local and CD pipelines. That’s why I built Envilder. A CLI tool to automate the generation of .env files from a single source of truth: AWS SSM. It helps us: Keep secrets in one place (SSM) Stay consistent across teams and environments Avoid copy-pasting or writing fragile scripts Since we often work with multiple AWS CLI profiles, Envilder also supports switching profiles easily to handle multi-account setups. 👉 GitHub repo 👉 [Full guide continues below ⬇️] 💡 What does it do? Envilder reads a mapping file that links environment variable names to AWS SSM parameter paths. Then it fetches the values securely and writes a clean .env file. 🧩 Example Your param-map.json might look like this: { \"DB_HOST\": \"/my-app/dev/DB_HOST\", \"DB_PASSWORD\": \"/my-app/dev/DB_PASSWORD\" }Enter fullscreen mode Exit fullscreen mode Run: envilder --map=param-map.json --envfile=.envEnter fullscreen mode Exit fullscreen mode And you get: DB_HOST=mydb.cluster-xyz.rds.amazonaws.com DB_PASSWORD=supersecretEnter fullscreen mode Exit fullscreen mode You can also use different AWS CLI profiles: AWS_PROFILE=staging envilder --map=param-map.json --envfile=.envEnter fullscreen mode Exit fullscreen mode 👥 Why it helps teams This small tool makes a big difference when: 🧑‍💻 Onboarding new team members: no more “what’s the DB password?” 🔄 Keeping environments in sync: any change in SSM is reflected across the team ⚙️ CI/CD pipelines always up-to-date: e.g. GitHub Actions, CodeBuild, GitLab 🧼 Centralized configuration: avoid duplication and keep secrets in one secure place 🧭 Supports multiple AWS profiles: ideal for multi-account or multi-env setups ✅ Features Works with SecureString and plain parameters CLI-first, fast, and script-friendly Compatible with any CI/CD system Supports static values and fallbacks AWS profile support (AWS_PROFILE) 📦 Install npm install -g envilderEnter fullscreen mode Exit fullscreen mode Or: envilder --map=param-map.json --envfile=.env --profile=aws-accountEnter fullscreen mode Exit fullscreen mode 🙌 I’d love your feedback It’s still an early-stage project, but already helpful in several real-world teams. If this sounds familiar, or you’ve solved this differently, I’d love to hear from you. GitHub: https://github.com/macalbert/envilder Update (2026): That was stage 1: a CLI that writes .env files. Envilder has since leveled up with SDKs for three languages, push mode, and Azure support. → Next level: One year of Envilder","contentHash":"sha256:40e7b59ce384e3c06791e625f40303681a8c3a52b0776b13b2266dde67c45717","authorName":"Marçal Albert Castellví","authorUrl":"https://zyvop.com/author/mac","authorSameAs":["https://envilder.com","https://github.com/macalbert","https://linkedin.com/in/linkedin.com/in/macalbert"],"category":null,"tags":["AWS","opensource","DevOps","cli"],"audience":"Software engineers and developers building applications with AWS","tone":"Professional, principal software engineer perspective","readingTimeMinutes":2,"wordCount":488,"faqs":null,"primaryTopic":"AWS","publishedAt":"2025-03-10T00:00:00.000Z","updatedAt":"2026-10-24T09:30:36.528Z","canonicalUrl":"https://dev.to/macalbert/stop-hardcoding-secrets-generate-env-files-from-aws-ssm-with-a-simple-cli-f77"}