Repository navigation
feat(secret): set app.yaml secrets from the CLI - #6
Merged
Merged
Conversation
Secrets declared in app.yaml resources.secrets are created with a PLACEHOLDER value, and developers had no way to set the real one. javabin secret list shows which still hold PLACEHOLDER (never the values); javabin secret set <name> stores a value as an SSM SecureString under /javabin/apps/<team>/<app>/, prompting without echo or reading --stdin, and --restart forces a new ECS deployment so tasks pick it up. Only names declared in app.yaml are accepted. Needs the developer permission set change in javaBin/platform (terraform/org, human-applied). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…Ctrl-C - set checks the parameter exists first and refuses to create it (the platform creates declared secrets on deploy) - remove --restart / ECS UpdateService; the platform restarts the service automatically when a secret changes (javaBin/platform#139) - restore the terminal if interrupted during the hidden prompt - document why list decrypts; update CLAUDE.md Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Alexanderamiri
added a commit
to javaBin/platform
that referenced
this pull request
Oct 23, 2026
## Why
`app.yaml` `resources.secrets` are created with the value `PLACEHOLDER`,
but the `javabin-developer` permission set can only *read*
`/javabin/apps/<team>/*`, so no team can give its secrets real values.
cupcake needs `SP_USER`, `SP_PASSWORD`, `BRING_API_USER` and
`BRING_API_KEY`.
## What changed
- **`terraform/org/identity-center.tf`, `javabin-developer`
(human-applied):**
- `ssm:PutParameter`, `LabelParameterVersion` and `GetParameterHistory`
on `/javabin/apps/${PrincipalTag/team}/*`, **only for parameters tagged
with that team**. That means only secrets the platform created; a
hand-made parameter would break the app's next `terraform apply`.
- An explicit Deny on `*/cognito-client-*`, `*/auth` and
`*/db-master-password`, which are platform-managed.
- **New Lambda `javabin-app-secret-rollout` (CI-applied):** on an SSM
`Update` under `/javabin/apps/`, it forces a new deployment of
`{team}-{app}`, because ECS reads secrets only at task start. Developers
get no `ecs:UpdateService`: that action would also let them change
networking and task definitions.
- **Docs:** app-yaml-reference, lambda-functions, CLAUDE.md. The CLI
side is javaBin/javabin-cli#6, `javabin secret list/set`.
## Applying
- Merging applies the Lambda through platform CI.
- `terraform/org` must be applied by hand: `cd terraform/org &&
terraform plan && terraform apply` (javabin admin). It should show one
in-place update to
`aws_ssoadmin_permission_set_inline_policy.developer`.
## Known limit
A session carries a single `team` tag. A hero in several teams can
manage only the team their session is tagged with.
## Checks
- Lambda tests pass, including the new `test_app_secret_rollout.py`.
- `terraform validate` passes on `terraform/platform` and
`terraform/org`.
- An independent review agent's findings are addressed: the tag
condition, the `db-master-password` deny, and dropping UpdateService.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This was referenced Oct 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
javabin secretfor setting values of secrets declared inapp.yaml(resources.secrets).javabin secret list— shows which declared secrets still holdPLACEHOLDER(decrypts only to compare; values are never printed)javabin secret set <name> [--stdin]— hidden prompt (terminal restored on Ctrl-C) or stdin; overwrites the existing SSM SecureString under/javabin/apps/<team>/<app>/<name>. Never creates parameters: if it doesn't exist yet, deploy first (the platform creates declared secrets, and IAM denies writes to parameters not tagged with the team)<team>-<app>automatically when a secret changes (feat(org): let developers set their own team's app secrets platform#139)Tests cover path/app.yaml parsing, input validation, and the not-found vs exists behaviour of
set.🤖 Generated with Claude Code