Configure secrets as Elastic Beanstalk environment variables

Elastic Beanstalk fetches secrets during the instance deployment and makes them available as environment variables to your application. Beanstalk also makes the secrets available as environment variables in platform hook scripts and ebextensions container commands. If you want to use the secrets as part of a script you run on each deployment, I recommend using a platform hook or ebextension.

The secrets are not made available to /opt/elasticbeanstalk/bin/get-config environment nor during SSH sessions. If you need the secret during an SSH session, you can retrieve it using the aws secretsmanager get-secret-value CLI.

You can verify when a secret was fetched during a deployment by checking /var/log/eb-engine.log. You should find a log message like Fetching Secrets Manager secret: followed by the secret ARN. If Beanstalk fails to fetch the secret during a deployment, you should see an error message in /var/log/eb-engine.log and an event message in your environment.

The integration of AWS Secrets Manager with Elastic Beanstalk environment variables works differently from regular environment variables. Secrets are not stored in plain text on the EC2 instance, and they are not directly visible when using the /opt/elasticbeanstalk/bin/get-config environment command.

Instead, Elastic Beanstalk fetches the secrets from AWS Secrets Manager during instance bootstrapping and assigns them to environment variables for your application to use. This process happens securely, and the secrets are not exposed in plain text on the instance.

To verify that secrets are being injected into environment variables, you should check your application's ability to access these variables rather than looking for them directly on the EC2 instance. The secrets should be available to your application when it starts up, but they won't be visible in the instance's environment or configuration files for security reasons.

If you're having trouble accessing the secrets in your application, you can try the following steps:

1. Double-check that you've correctly configured the secret in your Elastic Beanstalk environment. You can do this through the Elastic Beanstalk console, .ebextensions configuration files, or the AWS CLI.

2. Ensure that your application is attempting to access the secret using the correct environment variable name.

3. If you're still experiencing issues, you may want to add some logging in your application to check if it can read the environment variables at runtime.

4. Review the Elastic Beanstalk environment's events and logs for any error messages related to secret retrieval.

5. Verify that your Elastic Beanstalk environment is using a supported platform version that includes this feature.

If you've confirmed all of the above and are still unable to access the secrets in your application, you may want to contact AWS support for further assistance.

It's important to note that this integration is designed to provide a more secure way of handling sensitive information compared to regular environment variables. The secrets are not meant to be directly visible on the EC2 instance, which is why you don't see them when using the get-config command.
Sources
Fetching secrets and parameters to Elastic Beanstalk environment variables - AWS Elastic Beanstalk
Using Elastic Beanstalk with AWS Secrets Manager and AWS Systems Manager Parameter Store - AWS Elastic Beanstalk
Release: Elastic Beanstalk supports retrieving secrets and configuration from AWS Secrets Manager and AWS Systems Manager on March 31, 2025 - AWS Elastic Beanstalk

When my application runs, it correctly receives the environment variables with the secret values, confirmed by the app output.

However, I want to run CLI commands or database migrations directly on the instance shell with the correct environment variables set, ideally without needing to redeploy or modify the application code.

My questions are:

How can I access or obtain the environment variables that Elastic Beanstalk injects from Secrets Manager for use in the instance shell or during SSH sessions?

What is the recommended way to run CLI commands or migrations on the instance with those secrets available as environment variables?