designslife/WebForm-mw
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

AMPLIFY_DEPLOY: document Gen 2 Environment variables vs Secrets split

Browse Source 
Amplify Gen 2's console has two separate pages for runtime config:
Environment variables (plaintext) and Secrets (SSM Parameter Store
SecureString). The earlier 'mark as Secret with eye icon' wording was
Gen 1; in Gen 2 you choose by which page you add the value on.

Step 2 rewritten:
- Brief explanation of both pages and how they're injected (both end
  up as plain env vars in the app, same name).
- Combined variable table with a Page column showing where each value
  lives.
- Rule-of-thumb: anything that would let someone impersonate the app
  to CiviCRM or bypass a gate is a Secret; hostnames/usernames are
  fine in Environment variables.
- Callout reminding not to duplicate names across both pages
  (precedence undefined in Gen 2).
This commit is contained in:
Joel Brock
2026-05-19 17:28:24 -07:00
parent e90d007513
commit 97222afe58
1 changed files with 33 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AMPLIFY_DEPLOY.md
+33 -23
View File
@@ -32,36 +32,46 @@ through managed Lambda behind a CloudFront CDN. The `amplify.yml` and
6. Amplify reads `amplify.yml` automatically; you do not need to edit
the build spec on this screen. Click **Next**.
## Step 2 — Environment variables
## Step 2 — Environment variables and Secrets
On the environment-variables screen, add the following. Required ones first:
Amplify Gen 2 splits configuration across **two separate pages** in the
console sidebar (under **Hosting**):
| Variable | Value |
|---|---|
| `CIVI_BASE_URL` | e.g. `https://crm.fci.coop` |
| `CIVI_API_KEY` | mark as **Secret** (eye icon on the value field) |
| `CIVI_SITE_KEY` | mark as **Secret** |
- **Environment variables** — plaintext-at-rest, intended for non-sensitive
config. Readable by anyone with `amplify:GetApp` permission on the AWS
account.
- **Secrets** — values stored in AWS Systems Manager Parameter Store as
SecureString, encrypted at rest. Injected into the build/runtime as
normal environment variables under the same name, so application code
doesn't need to know the difference.
Do **not** set `NODE_ENV=production` in the Amplify panel. Amplify and Next
already set it correctly at runtime; setting it at build time causes
`npm ci` to skip devDependencies, which breaks the Tailwind/PostCSS step.
The `amplify.yml` in this repo guards against this with `--include=dev`,
but it's cleaner not to set it at all.
Add each variable to the page indicated below:
Optional, only if relevant:
| Variable | Page | Notes |
|---|---|---|
| `CIVI_BASE_URL` | Environment variables | e.g. `https://crm.fci.coop` |
| `CIVI_API_KEY` | **Secrets** | Required |
| `CIVI_SITE_KEY` | **Secrets** | Required |
| `CIVI_HTTP_AUTH_USER` | Environment variables | Only if CiviCRM has webserver-level Basic Auth in front of it |
| `CIVI_HTTP_AUTH_PASS` | **Secrets** | Only if above set |
| `HEALTH_TOKEN` | **Secrets** | Optional; gates `/api/health` in production |
| `PREVIEW_ADMIN_TOKEN` | **Secrets** | Optional; gates `/api/preview-link` |
| Variable | When |
|---|---|
| `CIVI_HTTP_AUTH_USER` | CiviCRM has webserver-level Basic Auth in front of it |
| `CIVI_HTTP_AUTH_PASS` | same — mark **Secret** |
| `HEALTH_TOKEN` | gates `/api/health` in production — mark **Secret** |
| `PREVIEW_ADMIN_TOKEN` | gates `/api/preview-link` — mark **Secret** |
Rule of thumb: if leaking the value would let someone impersonate the app
to CiviCRM, or bypass a gate, it goes in **Secrets**. Hostnames and
usernames are fine in plaintext Environment variables.
"Secret" values are encrypted at rest in AWS Systems Manager Parameter
Store and only injected into the build/runtime environment. They are not
visible in logs or to anyone without `amplify:*` IAM permissions.
> **Don't set `NODE_ENV=production` in either page.** Amplify and Next
> already set it correctly at runtime; setting it at build time causes
> `npm ci` to skip devDependencies, which breaks the Tailwind/PostCSS
> step. The `amplify.yml` in this repo guards against this with
> `--include=dev`, but it's cleaner not to set it at all.
Click **Next**, review, **Save and deploy**.
> **Don't duplicate names across both pages.** If the same variable
> name appears in both Environment variables and Secrets, Amplify's
> precedence is undefined in Gen 2.
Click through, review, **Save and deploy**.
## Step 3 — First build