feat(infra): one password env variables #2710
Conversation
| @@ -1,7 +1,13 @@ | |||
| { | |||
| "name": "infra", | |||
| "scripts": { | |||
There was a problem hiding this comment.
I think we could just do e.g. "review" as ENV and fill in the e.g. op://DevOps/passport-$ENV-secrets/CI/BLA, since we are keeping this naming convention across all the repos. But also, it's great as-is!
infra/.env.pulumi
Outdated
| @@ -0,0 +1,28 @@ | |||
| # One Password | |||
| # Secrets | |||
| IAM_SERVER_SSM_ARN=op://DevOps/$APP_SECRETS/iam/DATA_SCIENCE_API_URL | |||
There was a problem hiding this comment.
Keeping the secrets/env that are only really relevant to e.g. the lambda or EC2 envs in the relevant app secion, e.g. /iam/ is a great idea! That way we won't need to delete those when we're coming back through like we talked about. But I think the ones like "IAM_SERVER_SSM_ARN" or "ROUTE_53_ZONE" that are only used in the CI and not with the e.g. IAM environment probably belong in a /CI/ section (so that we're not injecting them into the iam environment unnecessarily)
Fixes: #2628