Skip to main content
Type: rvn-aws-secret · Latest version: 1.0.0

​
Readme

Generates a random value, such as an API key, master key, or session secret, and stores it in SSM Parameter Store or Secrets Manager. The value never appears in Terraform state, plans, Ravion, or your project config.

​
Overview

Use this module when an app needs a secret that nobody has to type in or copy around. The module generates the value during apply and writes it directly to AWS. It only outputs the parameter or secret ARN and name, so other modules can reference the secret without ever seeing it.

​
Using the secret in a service

Pass the arn output to an ECS service as a runtime secret:
ECS reads the value when each task starts. ECS services created with Ravion can already read parameters and secrets in the same AWS account and region.

​
Stores

​
Replication

Secrets Manager replicas are read-only copies kept in sync by Secrets Manager with the same name as the primary secret. Their ARN differs only by Region, so use the replica_arns output for services running in each replica Region. When you provide a customer managed KMS key, replicas use it only when you provide an alias that exists in each replica Region. Key IDs and ARNs are Region-specific, so replicas fall back to the AWS managed key.

​
Rotation

Increase Rotation version to generate a new value and overwrite the stored one. Changes to Length or Special characters only take effect on the next rotation, so the current value never changes unexpectedly. Services pick up the new value the next time their tasks start, for example on their next deploy.

​
Configuration

​
Design decisions

The value is generated with an ephemeral resource and written through write-only arguments. OpenTofu never persists ephemeral values or write-only arguments, so the value exists only in Parameter Store or Secrets Manager. This requires OpenTofu 1.11 or later. Store, name, AWS account, and Region are immutable because changing them creates a different parameter or secret, and services referencing the old ARN would lose access.

​
Learn more

​
Inputs reference

All inputs for rvn-aws-secret version 1.0.0. Use the name shown for each field as the input key in module config.

​
AWS account & region

​
string
required
AWS account.
  • Immutable after creation
​
string
required
Region.
  • Immutable after creation

​
Secret

​
string
required
Store. Parameter Store is free and regional. Secrets Manager costs about $0.40 per secret per Region per month and can replicate to other Regions.
  • Default: parameter_store
  • Allowed values: parameter_store (SSM Parameter Store), secrets_manager (Secrets Manager)
  • Immutable after creation
​
string
required
Name. Parameter Store adds a leading slash and doesn’t allow + = @ or names starting with aws or ssm. Can’t be changed later.
  • Default: ravion/<<project.given_id>>/<<environment.given_id>>/<<module.given_id>>
  • Immutable after creation
  • Pattern: ^/?[A-Za-z0-9_.+=@-]+(/[A-Za-z0-9_.+=@-]+)*$ — Up to 512 letters, numbers, and . _ - + = @ /, with no empty path segments.
​
number
required
Length. Characters in the generated value, from 16 to 512. Applies on the next rotation.
  • Default: 32
  • Min: 16
  • Max: 512
​
number
required
Recovery window (days). How long a deleted secret can be restored before AWS removes it for good.
  • Default: 30
  • Min: 7
  • Max: 30
  • Shown when: {"store":"secrets_manager"}
​
string_array
Replica regions. Additional Regions that receive a copy of the secret. Services in those Regions use the replica ARN from the replica_arns output.
  • Default: []
  • Shown when: {"store":"secrets_manager"}
​
boolean
Special characters. Leave off for values used in URLs, headers, or connection strings. Applies on the next rotation.
  • Default: false
​
number
required
Rotation version. Increase to replace the stored value. Services pick it up when their tasks next start.
  • Default: 1
  • Min: 1
​
string
KMS key. Customer managed key for encryption. Leave blank to use the AWS managed key.

​
Misc

​
keyvalue
Tags. A map of tags to assign to all resources. Default tags are Owner, ProjectGivenId, EnvironmentGivenId, ModuleGivenId, ModuleId

​
Terraform settings

​
string
OpenTofu version override. Override the environment’s default version for this module
​
string
Ravion Terraform workspace name. Override Terraform state backend workspace name. Defaults to project + environment + module given ids.
  • Immutable after creation
​
object
Advanced Terraform variables. Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.
  • Default: {}
​
string
Terraform execution environment. Override the execution environment for Terraform runners. Must use the same AWS account as selected above.