is it possible to inject secret env into apprunner's build phase?


Actually I've this configuration

version: 1.0
runtime: nodejs18

      - npm install
      - npm run build
      - npm test
  runtime-version: 18.19.0
  command: npm run start
    port: 8000
    env: SERVER_PORT
    - name: SECRETS
      value-from: arn:aws:secretsmanager:eu-central-1:936969959426:secret:xxxxxx-xxxxxx

However, I need to use the same secret in the build phase of this configuration. This secret contains all reserved env variables and I can't share it with my config. Indeed, this project is on GitHub and AWS Apprunner detects any update to the codebase. Any solution or suggestion?

asked 4 months ago287 views
2 Answers

You can use in below the method as mention in Environment Variables in AWS AppRunner: AWS AppRunner allows you to set environment variables that are not stored in your codebase. You can set your secret as an environment variable in the AWS AppRunner configuration. This way, your secret is not exposed in your GitHub repository.

AWS Secrets Manager: Utilize AWS Secrets Manager to store your sensitive data. Secrets Manager allows you to programmatically retrieve secrets in your build process without hardcoding them in your source code or configuration files. You can set up IAM roles and permissions to allow your AWS AppRunner instance to access these secrets. Please find the below sample code

  • name: Retrieve secret from AWS Secrets Manager run: | SECRET=$(aws secretsmanager get-secret-value --secret-id MySecretName --query SecretString --output text) echo "SECRET=$SECRET" >> $GITHUB_ENV

    • name: Build and Deploy run: |

      Use the secret in your build process

      export MY_SECRET_KEY=$(echo $SECRET | jq -r .MY_SECRET_KEY)

profile picture
answered 4 months ago
  • Sorry but I can't understand your reply. Probably you're referring to Cloud Formation but please take your time to review my question and my configuration yaml file.


There is no way to do this currently - it's a nearly 3-year old request to the AWS App Runner team on Github that has been in a "we are working on it" phase since November of 2022.

answered 3 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions