Is there a way to hide environment variables in AWS Elastic Beanstalk?

Question

My elastic beanstalk application has several environment variables that are confidential (e.g. API keys, hash secrets, etc.). I would like to configure AWS so that most developers can view and edit config, etc., but they cannot see some of these environment variables. This would be a big overhead if we had to change all this every time the developer leaves, for example.

Because of the game with permissions (at least with the help of Elastic Beanstalk), you can either have full access to the config or not see any of them - and completely removing access means that the developer can’t even perform basic something like of why the deployment failed.

I am wondering if there is another approach to environment variables that can allow me to give developers access to this configuration, but it is not clear that this is very confidential material. Can I put secret env vars in a file on the server?

Is there any other way to do this?

Answer 1

One way to get closer to this is to use the IAM role of your EC2 instance with an elastic beanstalk. You can store information in a resource inaccessible to your developers, but it can be accessed by an instance of EC2, because it takes a certain role.

Amazon has a blog post on how to do this, using the S3 encrypted bucket and AWS KMS to store the encryption key. It's about using it for Docker containers in an EC2 container, but the principle is the same.