Clojurians Log v2

What do people use to manage environment variables, parameters and secrets? I have a full stack app using terraform. So I'm dealing with: - Building a shadow-cljs project, injecting env vars for auth, backend, google api keys, - Running a backend service that needs api keys, database credentials - Managing CI which need access to parameters and secrets for builds and deployment - Managing terraform which requires input variables for my terraform configuration and also outputs that are passed into other services (for example frontend and backend) - Developing locally where I need access to those variables, parameters and secrets in some capacity - Right now I've hacked together a combination of: - Terraform passing vars, parameters and secrets into services such as the backend - Defining env vars into my CI using their environment variable store - Pulling env vars from terraform outputs when needed for building and deploying. Ideally I'd like to manage all this centrally some how. What have people use in the past for consolidating all this?

SSM Parameter store

How do you do local (offline?) development when your stack depends on AWS stuff?

I can see some things (e.g. SQS) can be reasonably abstracted out via an interface that has a local naive implementation.

I usually have dev account(s) on AWS and I use real services when developing. In simple cases I have used DynamoDB local and local Postgres. Mocking all the services seems too much hassle to me.

How is the experience of doing that? In terms of network issues, delays, latency etc.

I use a develop account for stuff I cannot easily replicate locally. My webapp, backend and db is local.

When we have another dev helping we step on each other's toes though. Ideally we would each have their own account and environment

haven't gotten to it, but namespacing resources via Terraform would be neat in shared dev account.

I guess it depends on the case/project, if there isn't any costly infrastructure, then separated accounts for each dev would be maximum isolation, but in a bigger system, one might want to share data sources, which means cross account policies

separate account per stage is good for hygiene anyway

in a previous project, we used Kinesis from https://github.com/localstack/localstack in tests, but it was a bit of a hassle to avoid timing related brittleness

but also used resources in dev account for running tests, since running tests against real infrastructure made sense in a data pipeline (Redshift+S3)

in that project, we used Ansible Vault for keeping secrets in version control (a tad bit legacy, since we initially started with Ansible), passed secrets to Terraform in a runner script via -var-file + process substitution (http://tldp.org/LDP/abs/html/process-sub.html) and stored state files in S3 with KMS encryption. We had utility libraries to read parameters from SSM, Terraform state and local per-env config files. Config files were merged so that overrides could be defined (in TF, passing first the prod config var file, then env specific var file. Same done in libraries).

Does anyone know if you can use AWS cognito with your own front-end forms (login/sign-up)?

Yes

You can use the JavaScript SDK to chat with Cognito directly from the browser. There are quite many moving parts so it’s probably a good idea to try find a reference implementation somewhere.

Oh wow, AWS has good examples nowadays https://docs.aws.amazon.com/cognito/latest/developerguide/using-amazon-cognito-user-identity-pools-javascript-examples.html

thanks @valtteri!