secret

A secret in your cloud's secret manager, whose value never enters the file.

A secret in your cloud's secret manager, created empty. Its value is set there — never in the file — and a connected service reads it when it starts.

ackee.ack

ackee 1
project "shop" {
  cloud  = "aws"
  region = "us-east-1"
}
service "web" {
  image = "public.ecr.aws/nginx/nginx:latest"
  port  = 80
}
secret "stripe" {
  description = "Stripe API key"
}
connect env "web" -> "stripe"

Fields

Field	Takes	Meaning
description	string	Shown beside the secret in your cloud console.

Any other field is refused (AK204), and the error names the exact type to declare with node for the setting you wanted.

What it becomes

Cloud	Becomes
AWS	An AWS Secrets Manager secret.
Google Cloud	A Secret Manager secret.
Azure	No portable form: an Azure secret lives inside a Key Vault, which holds many. Declare the vault with `node "x" type "azure/key-vault@1"` (AK212).

Joins the shared network net: none.

What a connection hands over

An env connection to a secret gives the consumer these variables, each prefixed by the secret's name in upper case — secret "orders" gives ORDERS_…:

Cloud	Variables
AWS	`_SECRET, read through the secrets channel at start`
Google Cloud	`_PASSWORD, read through the secrets channel at start`
Azure	`—`

Notes

The variable is named _PASSWORD on Google Cloud and _SECRET on AWS. Changing either would rename a variable running applications already read, so they stay as they are.
A service that reads a secret with no value cannot start (AK509). On Google Cloud that happens on the first deploy: set the value, then deploy again.