You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/pages/gen2/deploy-and-host/sandbox-environments/features/index.mdx
+74-30Lines changed: 74 additions & 30 deletions
Original file line number
Diff line number
Diff line change
@@ -18,28 +18,68 @@ Sandbox environments include additional features for managing secrets, deploying
18
18
## Secure secrets in your sandbox
19
19
20
20
<Calloutinfo>
21
+
21
22
Secrets set in a sandbox do not show up in the Amplify Console. You can view them in the AWS Systems Manager (SSM) Parameter Store console.
23
+
22
24
</Callout>
23
25
24
-
Amplify Gen 2 offers secure secret storage to manage sensitive data like API keys and database credentials. Secrets are similar to environment variables, but they are encrypted AWS Systems Manager Parameter Store key value pairs. Secrets are stored in AWS Parameter Store with the following naming convention: `/amplify/<package.json#name>/<sandbox-name>/<key-name>`.
26
+
Amplify Gen 2 offers secure secret storage to manage sensitive data like API keys and database credentials. Secrets are similar to environment variables, but they are encrypted AWS Systems Manager Parameter Store key value pairs. Secrets are stored in AWS Parameter Store under the `/amplify` prefix.
25
27
26
28
### Set secrets
27
29
28
-
You can add secrets while running your cloud sandbox with the following command:
30
+
You can add secrets to your sandbox environment using the following command:
29
31
30
32
```bash
31
33
npx amplify sandbox secret set foo
32
34
? Enter secret value: ###
33
35
Done!
34
36
35
-
>npx amplify sandbox secret set bar
37
+
npx amplify sandbox secret set bar
36
38
? Enter secret value: ###
37
39
Done!
38
40
```
39
41
40
-
### Access secrets
42
+
After these commands, your sandbox will have two secrets named `foo` and `bar`.
43
+
44
+
### List secrets
45
+
46
+
You can list all of the secret names available in your sandbox environment with the following command:
47
+
48
+
```bash
49
+
npx amplify sandbox secret list
50
+
- foo
51
+
- bar
52
+
```
53
+
54
+
### Retrieve a secret
55
+
56
+
<Calloutwarning>
57
+
58
+
**Note:** This will print a secret value in plain text to the terminal. Do not use this command anywhere that terminal logs may be stored (such as CI/CD jobs).
59
+
60
+
</Callout>
61
+
62
+
To show the value of a secret, run the following command.
63
+
64
+
```bash
65
+
npx amplify sandbox secret get foo
66
+
name: foo
67
+
version: 1
68
+
value: abc123
69
+
lastUpdated: Mon Nov 13 2023 22:19:12 GMT-0800 (Pacific Standard Time)
70
+
```
71
+
72
+
### Remove secrets
73
+
74
+
To remove a secret from from the sandbox, run the following command in your terminal:
75
+
76
+
```bash
77
+
npx amplify sandbox secret remove foo
78
+
```
79
+
80
+
### Reference secrets
41
81
42
-
Once you have set a secret, you can access the values in code by calling the `secret()` function. The following example shows how to set up social sign-in with authentication in your app. Depending on your environment, Amplify will automatically load the correct secret value with no extra configuration.
82
+
Once you have set a secret, you can reference the secret in your backend definition using the `secret()` function. The following example shows how to set up social sign-in with authentication in your app. Depending on your environment, Amplify will automatically load the correct secret value.
To get the value of a secret from the cloud, run the following command in your terminal:
102
+
The `secret()` function does NOT retrieve the value of the secret. It places a reference to the secret value in the backend definition. The secret value is only resolved during deployment of your backend.
65
103
66
-
```bash
67
-
npx amplify sandbox secret get foo
68
-
name: foo
69
-
version: 1
70
-
value: 123
71
-
lastUpdated: Mon Nov 13 2023 22:19:12 GMT-0800 (Pacific Standard Time)
72
-
```
104
+
The `secret()` function can only be used in specific places in your backend definition such as [configuring auth providers](/gen2/build-a-backend/auth/add-social-provider/#configure-social-sign-in-backend) and [granting function secret access](/gen2/build-a-backend/functions/#secret-access).
73
105
74
-
### Remove secrets
106
+
<Calloutinfo>
75
107
76
-
To remove a secret from the cloud, run the following command in your terminal:
108
+
To deploy a backend that uses `secret()` references via Amplify hosting, the secret values must be [configured for the Amplify app or branch](/gen2/deploy-and-host/fullstack-branching/secrets-and-vars)
77
109
78
-
```bash
79
-
npx amplify sandbox secret remove foo
80
-
```
110
+
</Callout>
81
111
82
-
###Work with multiple AWS profiles
112
+
## Work with multiple AWS profiles
83
113
84
-
Sometimes you might have multiple AWS profiles set up locally. To run `amplify sandbox secret` commands, use the `--profile` flag to deploy to a specific profile. For example, let's say you have two AWS profiles set up locally—`default` and `work`. To add secrets to the `work` profile, run the following command in your terminal:
114
+
Sometimes you might have multiple AWS profiles set up locally. To run `amplify sandbox secret` commands, use the `--profile` flag to deploy to a specific profile. For example, let's say you have two AWS profiles set up locally—`default` and `work`. To add secrets to the sandbox in the `work` profile, run the following command in your terminal:
85
115
86
116
```bash
87
117
npx amplify sandbox secret set foo --profile work
88
118
```
89
119
90
-
## Multiple sandboxes per app
120
+
## Work with multiple named sandboxes
91
121
92
122
<Calloutinfo>
93
-
Provisioning multiple sandboxes per app is possible but not recommended because managing multiple ephemeral environments for a single app introduces complexity. With multiple sandboxes, it can be difficult to keep track of what code version or configuration is deployed where. Sticking to a single ephemeral sandbox per app keeps your workflows simple and straightforward.
123
+
124
+
Provisioning multiple sandboxes per app is possible but not recommended because managing multiple ephemeral environments for a single developer introduces complexity. With multiple sandboxes, it can be difficult to keep track of what code version or configuration is deployed where. Sticking to a single sandbox per developer keeps your workflows simpler.
125
+
94
126
</Callout>
95
127
96
-
You can create multiple cloud sandbox environments for each app if you want to keep persistent sandbox environments up and running to test against. First, run the following command in the terminal:
128
+
You can create multiple sandboxes if you want to have different features or test environments available in different sandboxes. By default, your sandbox is named based on the local machine username. To override this name, use the `--identifier` option:
97
129
98
130
```bash
99
-
npx amplify sandbox --name s1
131
+
npx amplify sandbox --identifier feature1sandbox
100
132
```
101
133
102
-
Once the deployment completes, exit sandbox `s1` and run the following command in the terminal:
134
+
This will start a sandbox named `feature1sandbox`.
135
+
136
+
Once the deployment completes, exit sandbox and run the following command in the terminal:
103
137
104
138
```bash
105
-
npx amplify sandbox --name s2
139
+
npx amplify sandbox --identifier feature2sandbox
106
140
```
107
141
108
-
After successful deployment, sandboxes `s1` and `s2` will be ready. Pick sandbox `s1` or `s2` to activate. You can switch between them but only one can be running at a time.
142
+
After successful deployment, you will have two sandboxes `feature1sandbox` and `feature2sandbox`. You can switch between them but only one can be running at a time.
143
+
144
+
### Secret management with named sandboxes
145
+
146
+
When working with multiple sandboxes, secrets must be configured for each one. All of the `sandbox secret` commands accept the `--identifier` argument to manage secrets for named sandboxes. For example, to add a secret to `feature1sandbox`, use:
147
+
148
+
```bash
149
+
npx amplify sandbox --identifier feature1sandbox secret set baz
Amplify Gen 2 introduces a fully typed experience for data that no longer requires an explicit codegen step, unlike in Amplify Gen 1. You will only need this command if you are building a mobile app or have Gen 1 requirements.
169
+
170
+
Amplify Gen 2 introduces a fully typed experience for data that no longer requires an explicit codegen step, unlike in Amplify Gen 1. You will only need this command if you are building a mobile app or have Gen 1 requirements.
171
+
128
172
</Callout>
129
173
130
174
Codegen generates native code for Swift (iOS), Java (Android), and JavaScript that represents your GraphQL API's data models. It can also generate GraphQL statements (queries, mutations, and subscriptions) so that you don't have to manually code them.
0 commit comments