e2sm

.env to AWS Secrets Manager

Usage

npx e2sm init     # Create .e2smrc.jsonc config file
npx e2sm set      # Upload .env to Secrets Manager
npx e2sm get      # Display secret value
npx e2sm pull     # Download secret to .env file
npx e2sm delete   # Delete secret from Secrets Manager
npx e2sm --help   # Show help

Commands

init - Create configuration file

Creates a .e2smrc.jsonc configuration file in the current directory with commented examples.

npx e2sm init
npx e2sm init --force   # Overwrite existing file

| Flag | Short | Description | | --------- | ----- | ----------------------- | | --force | -f | Overwrite existing file |

set - Upload .env to Secrets Manager

npx e2sm set
npx e2sm set -i .env.local -n my-app/prod
npx e2sm set --dry-run                    # Preview JSON without uploading
npx e2sm set --force                      # Skip overwrite confirmation
npx e2sm set -t -a my-app -s prod         # Template mode: creates "my-app/prod"

| Flag | Short | Description | | --------------- | ----- | --------------------------------------- | | --input | -i | Path to .env file | | --name | -n | Secret name | | --dry-run | -d | Preview JSON output | | --force | -f | Skip overwrite confirmation | | --template | -t | Use template mode ($application/$stage) | | --application | -a | Application name (implies --template) | | --stage | -s | Stage name (implies --template) | | --profile | -p | AWS profile | | --region | -r | AWS region |

get - Display secret value

npx e2sm get
npx e2sm get -n my-app/prod
npx e2sm get -p my-profile -r ap-northeast-1

| Flag | Short | Description | | ----------- | ----- | ---------------------------------------- | | --name | -n | Secret name (skip interactive selection) | | --profile | -p | AWS profile | | --region | -r | AWS region |

pull - Download secret to .env file

npx e2sm pull
npx e2sm pull -n my-app/prod -o .env.local
npx e2sm pull --force                     # Overwrite existing file

| Flag | Short | Description | | ----------- | ----- | -------------------------------------------- | | --name | -n | Secret name (skip interactive selection) | | --output | -o | Output file path (default: .env) | | --force | -f | Overwrite existing file without confirmation | | --profile | -p | AWS profile | | --region | -r | AWS region |

delete - Delete secret from Secrets Manager

npx e2sm delete
npx e2sm delete -n my-app/prod -d 7
npx e2sm delete -n my-app/prod -d 7 --force

| Flag | Short | Description | | ----------------- | ----- | ---------------------------------------- | | --name | -n | Secret name (skip interactive selection) | | --recovery-days | -d | Recovery window in days (7-30) | | --force | -f | Skip confirmation prompt | | --profile | -p | AWS profile | | --region | -r | AWS region |

Configuration

Create a .e2smrc.jsonc file to set default options. JSONC format supports comments.

{
  "$schema": "https://unpkg.com/e2sm/assets/schema.json",
  // Secret name (cannot use with template mode)
  "name": "my-secret-name",
  // Or use template mode: generate secret name as $application/$stage
  // "template": true,
  // "application": "my-app",
  // "stage": "dev",
  // AWS settings
  "profile": "my-profile",
  "region": "ap-northeast-1",
  // File paths
  "input": ".env.local",
  "output": ".env",
}

Config file locations

Searched in order (first found is used):

1. ./.e2smrc.jsonc (project)
2. ./.e2smrc.json (project, backward compatibility)
3. ~/.e2smrc.jsonc (global)
4. ~/.e2smrc.json (global, backward compatibility)

Only the first found config is used (no merging).

Priority

CLI flags always take precedence over config file values.

# Uses profile from config
npx e2sm set

# Overrides config with "prod-profile"
npx e2sm set -p prod-profile