AWS Secrets Manager

Source server variables from AWS Secrets Manager.

bun add @aws-sdk/client-secrets-manager

import {
  configureResolver,
  createEnv,
  fromResolver,
  requiredString,
  server,
} from "@ayronforge/envil";
import { awsSecretsAdapter } from "@ayronforge/envil/aws";

const aws = configureResolver(awsSecretsAdapter, {
  region: "us-east-1",
});

export const appEnv = createEnv(
  server({
    DATABASE_PASSWORD: requiredString.pipe(
      fromResolver(aws, "production/database#password"),
    ),
  }),
);

Append #field to read one JSON field from a secret. Variables using the same configured aws value are resolved together. AWS batch requests are split into groups of at most 20 secret IDs.

A reliable not-found response becomes Option.none(). Other provider failures remain typed resolver errors.