Reference
Secrets
Every secret eode uses: its name in Secrets Manager, its format, and who creates it.
Every secret lives in AWS Secrets Manager under eode/, as a JSON object. The secrets driver syncs them into the
cluster; nothing secret is in the stack's parameters file, a template or a log.
| Secret | Holds | Set by |
|---|---|---|
eode/db | App database login (url) | The stack |
eode/db-owner | Owner database login (url), migration job only | The stack |
eode/cache | Redis login (url) | The stack |
eode/llm | LLM API key (apiKey) | You: LlmApiKey |
eode/signin | apiKey, webhookSecret | You: sign-in fields |
eode/signin-cookie | Session cookie key (cookieSecret) | The stack, once |
eode/data-connections | Data-connection encryption key (key) | The stack, once |
eode/probe | Health-probe token (token) | The stack |
eode/db-owner-credentials | Database owner user name and password, the source of eode/db-owner | The stack |
eode/cache-auth | Redis AUTH token, the source of eode/cache | The stack |
The url values look like this:
eode/db, eode/db-owner postgresql+psycopg://USER:PASSWORD@HOST:5432/DB?sslmode=require
eode/cache rediss://:PASSWORD@HOST:6379/0The two keys marked "once" are 44-character Fernet keys.
Rotate a secret
- Put the new value in Secrets Manager. For LlmApiKey or the sign-in fields, update the stack field instead.
- Change RestartToken on the stack (Settings) so eode restarts and reads it.
- Revoke the old value where it came from.
Don't rotate eode/data-connections: saved data-connection credentials are encrypted with it and can't be read
after it changes. Rotating eode/signin-cookie signs everyone out.
Who can read what
| Workload | Reads |
|---|---|
eode-app, eode-mcp | Everything except eode/db-owner |
eode-migrate | eode/db and eode/db-owner |
Each has its own IAM role through EKS Pod Identity; with KmsKeyArn set, the secrets are encrypted with your key.