is it possible to inject secret env into apprunner's build phase?

Question

Actually I've this configuration

```
version: 1.0
runtime: nodejs18

build:
  commands:
    pre-build:
      - npm install
    build:
      - npm run build
    post-build:
      - npm test
run:
  runtime-version: 18.19.0
  command: npm run start
  network:
    port: 8000
    env: SERVER_PORT
  secrets:
    - name: SECRETS
      value-from: arn:aws:secretsmanager:eu-central-1:936969959426:secret:xxxxxx-xxxxxx
```
However, I need to use the same secret in the build phase of this configuration. This secret contains all reserved env variables and I can't share it with my config. Indeed, this project is on GitHub and AWS Apprunner detects any update to the codebase.
Any solution or suggestion?

Answer

You can use in below the method as mention in 
Environment Variables in AWS AppRunner: AWS AppRunner allows you to set environment variables that are not stored in your codebase. You can set your secret as an environment variable in the AWS AppRunner configuration. This way, your secret is not exposed in your GitHub repository.

AWS Secrets Manager: Utilize AWS Secrets Manager to store your sensitive data. Secrets Manager allows you to programmatically retrieve secrets in your build process without hardcoding them in your source code or configuration files. You can set up IAM roles and permissions to allow your AWS AppRunner instance to access these secrets. Please find the below sample code

- name: Retrieve secret from AWS Secrets Manager
      run: |
        SECRET=$(aws secretsmanager get-secret-value --secret-id MySecretName --query SecretString --output text)
        echo "SECRET=$SECRET" >> $GITHUB_ENV

- name: Build and Deploy
      run: |
        # Use the secret in your build process
        
        export MY_SECRET_KEY=$(echo $SECRET | jq -r .MY_SECRET_KEY)

Answer

There is no way to do this currently - it's a nearly 3-year old request to the AWS App Runner team on Github that has been in a "we are working on it" phase since November of 2022.

is it possible to inject secret env into apprunner's build phase?

Use the secret in your build process

Relevant content