secretsprovider

README

secrets-provider

A Go library for retrieving secrets and database configuration from various providers (Environment variables or AWS Secrets Manager).

Features

• Abstracted Provider Interface: Switch between local environment and cloud providers without changing application logic.
• In-Memory Caching (AWS): The AWS provider automatically caches secrets in memory to reduce latency and API costs.
• Database Configuration Support: Helper to retrieve and parse database connection details (URL, Username, Password).

Installation

go get github.com/service-atlas/secrets-provider

Usage

1. Initialize the Provider

The library uses the SECRETS_PROVIDER environment variable to determine which provider to use.

import (
    "context"
    "log"
    "github.com/service-atlas/secrets-provider"
)

func main() {
    ctx := context.Background()
    provider, err := secretsprovider.NewProvider(ctx)
    if err != nil {
        log.Fatalf("failed to create provider: %v", err)
    }

    // Use the provider...
}

2. Retrieve a Simple Secret

secret, err := provider.GetSecret(ctx, "MY_SECRET_NAME")
if err != nil {
    log.Fatalf("failed to get secret: %v", err)
}
fmt.Printf("Secret: %s\n", secret)

3. Retrieve Database Configuration

The GetDatabaseInfo method returns a DatabaseInfo struct containing URL, Username, and Password.

dbInfo, err := provider.GetDatabaseInfo(ctx)
if err != nil {
    log.Fatalf("failed to get db info: %v", err)
}
fmt.Printf("Connecting to %s as %s\n", dbInfo.URL, dbInfo.Username)

Configuration

Environment Provider (Default)

Used when SECRETS_PROVIDER is empty or set to env.

• GetSecret(name): Looks up the environment variable name.
• GetDatabaseInfo(): Looks up DB_URL, DB_USERNAME, and DB_PASSWORD.

AWS Secrets Manager Provider

Used when SECRETS_PROVIDER=aws.

• Caching: Uses the AWS Secrets Manager Caching Library to store secrets in memory, reducing API calls and improving performance.
• GetSecret(name): Fetches the secret with ID name from the cache (or AWS Secrets Manager if not cached).
• GetDatabaseInfo():
  1. Reads the environment variable DATABASE_SECRET_NAME.
  2. Fetches that secret from AWS (expected to be a JSON string).
  3. Unmarshals it into a DatabaseInfo struct.

Expected JSON format for AWS Database Secret:

{
  "url": "bolt://localhost:7687",
  "username": "neo4j",
  "password": "password"
}

Development

The project includes a justfile for common tasks:

• just test: Run short tests.
• just test-full: Run all tests (including AWS integration tests using Testcontainers).
• just lint: Run linter.

Documentation

Index

• type AWSProvider
  • func (p *AWSProvider) GetDatabaseInfo(ctx context.Context) (DatabaseInfo, error)
  • func (p *AWSProvider) GetSecret(ctx context.Context, name string) (string, error)
• type DatabaseInfo
• type EnvProvider
  • func (p *EnvProvider) GetDatabaseInfo(ctx context.Context) (DatabaseInfo, error)
  • func (p *EnvProvider) GetSecret(_ context.Context, name string) (string, error)
• type Provider
  • func NewProvider() (Provider, error)

Types

type AWSProvider

type AWSProvider struct {
	// contains filtered or unexported fields
}

AWSProvider is a secrets provider that fetches and caches secrets from AWS Secrets Manager.

func (*AWSProvider) GetDatabaseInfo

func (p *AWSProvider) GetDatabaseInfo(ctx context.Context) (DatabaseInfo, error)

GetDatabaseInfo retrieves database connection information from an AWS Secrets Manager secret. It looks up the secret name from the DATABASE_SECRET_NAME environment variable. Returns an error if the environment variable is not set, if the secret is not found, or if the secret is invalid JSON.

func (*AWSProvider) GetSecret

func (p *AWSProvider) GetSecret(ctx context.Context, name string) (string, error)

GetSecret retrieves the value of a secret by its name from AWS Secrets Manager or its cache. It returns an error if the secret is not found, has no string value, or another issue occurs.

type DatabaseInfo

type DatabaseInfo struct {
	URL      string `json:"url"`
	Username string `json:"username"`
	Password string `json:"password"`
}

type EnvProvider

type EnvProvider struct{}

EnvProvider retrieves secrets from environment variables instead of external secret management systems.

func (*EnvProvider) GetDatabaseInfo

func (p *EnvProvider) GetDatabaseInfo(ctx context.Context) (DatabaseInfo, error)

GetDatabaseInfo retrieves database connection information, including URL, username, and password, from environment secrets. Returns a DatabaseInfo struct and an error if any required secret is missing or could not be retrieved.

func (*EnvProvider) GetSecret

func (p *EnvProvider) GetSecret(_ context.Context, name string) (string, error)

GetSecret retrieves the value of a secret identified by `name` from environment variables or returns an error if not found.

type Provider

type Provider interface {

	// GetSecret retrieves the secret value associated with the provided name from the underlying storage or environment.
	GetSecret(ctx context.Context, name string) (string, error)

	// GetDatabaseInfo retrieves database connection details such as URL, username, and password from the underlying provider.
	GetDatabaseInfo(ctx context.Context) (DatabaseInfo, error)
}

func NewProvider

func NewProvider() (Provider, error)

NewProvider creates a new secrets Provider based on the SECRETS_PROVIDER environment variable. Returns an AWSProvider if SECRETS_PROVIDER is set to "aws", otherwise defaults to an EnvProvider.