#Npm serverless appsync plugin how to

It will then encrypt it on KMS and set the environment variables to your deployment runtime. Once you run sls deploy -s, it will fetch the vault and will try to find VAR_FOOR, VAR_BAR (using your secret path). It will fetch all passwords under those paths. It needs a structure at vault like, vault write secret/path_foo ANY_FOO=foo & vault write secret/path_bar ANY_BAR=bar

It needs a structure at vault like, vault write secret/path VAR_FOO=foo VAR_BAR=bar Using multiple paths secrets with multiples or single password custom: Then add your env var as a list environment: Using single path secrets with multiples passwords custom:

#Npm serverless appsync plugin how to

How to use it? Add those configs in your serverless.yml Using token method auth custom: So, I just store my secrets in KMS after we retrieve them from Vault and then my Lambda function will be able to decrypt them. Why KMS then?ДЄlthough we are using Vault, once we retrieve the secrets from it, they go plain text (not desirable).

This plugin is modified from serverless-api-cloudfront & serverless-domain-manager plugins to support AppSync instead of API Gateway.

When we decided move to lambda we didn't want to move anything else to aws (I know we are lock-in), but then we decided to keep vault as our secret manager. serverless-appsync-cloudfront Automatically creates properly configured AWS CloudFront distribution that routes traffic to AppSync. I have been using vault as my store secret and it's been working well since then I have managed to keep using it to any apps based on app authentication or keys trought my vault api. Since I started using lambda + serverless, I have been looking for something that could allow me deploy in a safe way (avoiding writing environment files or commiting my passwords on github to be able using a continuous deployment, so I decided to write my own plugin to solve this problem. Vault is an amazing tool to use to store secrets.

Npm serverless-appsync-plugin