v0.4.0

Added

• SYNCRET_INSTANCE_NAME — optional human-readable label for the deployment, shown in notification headers (e.g., *Syncret — Production*). Must be a single line of at most 64 characters.
• SYNCRET_TIMEZONE — optional IANA timezone for notification timestamps (e.g., America/New_York). Defaults to UTC. Invalid zones fail at startup. Timezone data is embedded in the binary via time/tzdata for Lambda environments.
• Enriched GChat notifications — messages now include AWS account ID, region, source and target secret names (extracted from ARNs), ECS cluster and services, Lambda request ID, and a localized timestamp. Each pipeline stage (target secret update, ECS force-deployment) is reported individually with its outcome (succeeded, failed, skipped, or not attempted). Errors shown in notifications are sanitized; raw details remain in CloudWatch Logs.

v0.3.0

Added

• Google Chat notifications — optional SYNCRET_GCHAT_WEBHOOK variable. When set, Syncret sends a notification after every execution (success and failure) with the event type, secret ARN, actions taken, status, and error message on failure. Notification failures are logged as warnings and do not affect the Lambda return value.

v0.2.0

Added

• SYNCRET_PROVIDER — required variable that selects the cloud provider. Currently only aws is supported; unsupported values fail at startup.

Changed

• Breaking: environment variable renames — all provider-specific variables now carry an explicit cloud prefix to clearly separate provider namespaces:
  • SYNCRET_SECRET_ARN → SYNCRET_AWS_SECRET_ARN
  • SYNCRET_TARGET_SECRET_ARN → SYNCRET_AWS_TARGET_SECRET_ARN
  • SYNCRET_ECS_FORCE_DEPLOY → SYNCRET_AWS_ECS_FORCE_DEPLOY
  • SYNCRET_ECS_CLUSTER → SYNCRET_AWS_ECS_CLUSTER
  • SYNCRET_ECS_SERVICES → SYNCRET_AWS_ECS_SERVICES
  • SYNCRET_TARGET_SECRET_KEYS, SYNCRET_AWS_REGION, SYNCRET_LOG_LEVEL, SYNCRET_LOG_FORMAT — unchanged
• Documentation restructure — docs are now cloud-agnostic at the top level; provider-specific content lives under Deployment — AWS; Configuration page renamed to Reference with sections per provider

v0.1.0

Added

• Lambda handler triggered by EventBridge CloudTrail rules scoped to aws.secretsmanager events
• Event parsing for three event names, with ARN extraction per event type:
  • RotationSucceeded — ARN read from detail.additionalEventData.SecretId
  • PutSecretValue — ARN read from detail.requestParameters.secretId
  • RotationFailed — logs a warning and exits cleanly; no AWS calls are made
• Event source guard — rejects payloads with an unexpected source or eventSource before any AWS API call
• ARN guard — rejects events whose secret ARN does not match SYNCRET_SECRET_ARN
• Target secret update — reads the source secret and merges selected fields into a target secret (SYNCRET_TARGET_SECRET_ARN, SYNCRET_TARGET_SECRET_KEYS); key specs support src:dst remapping (e.g., password:DB_PASS); optional when ECS force deployment is configured
• Idempotent secret writes — ClientRequestToken is a UUID derived via SHA-256 from the target secret's current VersionId, so concurrent invocations processing the same rotation event produce the same token and the second write is a no-op
• ECS force-new-deployment — calls UpdateService with ForceNewDeployment=true for each service in SYNCRET_ECS_SERVICES; DescribeServices is batched in groups of 10 to respect the AWS API limit; inactive services are skipped with a warning; services not found in the cluster return an error; optional when target secret update is configured
• Startup validation — fails fast if SYNCRET_SECRET_ARN or SYNCRET_AWS_REGION are missing, if SYNCRET_TARGET_SECRET_ARN is set without SYNCRET_TARGET_SECRET_KEYS, or if neither flow is configured
• Structured logging via log/slog; request_id (Lambda AwsRequestID) is attached to every log line; level and format are configurable via SYNCRET_LOG_LEVEL (debug/info/warn/error, default: info) and SYNCRET_LOG_FORMAT (json/text, default: json); invalid values fail at startup
• Chainguard static base image — cgr.dev/chainguard/static; no shell, no package manager, minimal attack surface
• Multi-arch container — supports linux/amd64 and linux/arm64; ARM64 (Graviton) preferred for lower cost and better performance-per-watt
• Build-time version embedding — version string injected via -ldflags and logged at startup