FAQ

Why do you use an S3 bucket to store env vars?

You never want to store your service keys / credentials in version control. IAM policies for S3 allow for fine grain access control. You only give access to the bucket that contains env vars to people with authority to deploy code.

Why only 1 S3 bucket for env vars?

S3 buckets are a limited resource and one of the only globally unique assets in AWS. This combined with the fact that we prefer convention over configuration led us down this decision. Instead of one bucket per project per stage, we have one bucket and based on convention store data for your JAWS projects and stages.

The convention is:

s3://<proj jaws.json:envVarBucket.name>/JAWS/envVars/<projectName>/<stage>