LocalStack authentication without committing secrets

LocalStack now requires an authentication token. Fair enough. But where should that token live when you're running integration tests locally or in CI?

I ran into this while working with Docker Compose, Testcontainers, and .NET Aspire. I wanted a simple, repeatable setup without hardcoding credentials or passing secrets around between developers.

This two-part series walks through the approaches I ended up using with AWS SSM and Envilder.

What you'll learn

Part 1: LocalStack with Docker Compose

How to retrieve LOCALSTACK_AUTH_TOKEN from AWS SSM and generate a local .env file when Docker Compose needs one, without committing the token to Git.

Part 2: LocalStack with Testcontainers and Aspire

How to skip the .env file entirely and resolve the token directly at runtime, with working examples in TypeScript, Python, and .NET.

The idea behind it

Keep secret values outside Git, make secret dependencies explicit and version-controlled, and let each tool consume credentials in the way that makes sense.

This doesn't eliminate the need for proper access controls or runtime secret protection. It simply removes some unnecessary steps and opportunities for accidental exposure.

All examples are available in the Envilder examples repository.