How to expose secrets as environment variables in Elastic Beanstalk Docker platform

Question

Hello,

I am trying to use Elastic Beanstalk to run a node.js application that will talk to DocumentDB. I have stored the node.js docker image in ECR and I am providing Elastic Beanstalk Dockerrun.aws.json file that has the path to the image repository.

In order to talk the database my application needs to know about the database credentials which I am saving in Secrets Manager.

My question is how do I provide the values in the Secrets Manager to my application as environment variables. Since they are dynamic I cannot just add them directly in config files inside .ebextensions. I tried adding some logic in config file that would extract the secrets and add them to .env file inside /var/app/staging folder. I assumed that docker would automatically copy the .env file and pass it to my application root folder inside docker environment, but that does not seem to work. Note that I am not using docker compose.

Based on some documents I read, I don't think elastic beanstalk is integrated with Secrets Manager yet.

Any help would be greatly appreciated.

Yusuke Hayashi · Answer

This is now supported natively. Elastic Beanstalk platform versions released on or after March 26, 2025 can resolve Secrets Manager secrets (and Parameter Store parameters) during instance bootstrapping and expose the resolved value as an application environment variable. On the supported Docker platform, the application in the container can read that variable normally, so you do not need to create or copy a `.env` file.

For a JSON secret containing `username` and `password`, a current platform version can map the individual top-level keys in an `.ebextensions` file:

```yaml
# .ebextensions/environment-secrets.config
option_settings:
  aws:elasticbeanstalk:application:environmentsecrets:
    DOCDB_USERNAME: arn:aws:secretsmanager:us-east-1:111122223333:secret:docdb-AbCd12:username
    DOCDB_PASSWORD: arn:aws:secretsmanager:us-east-1:111122223333:secret:docdb-AbCd12:password
```

Replace those example ARNs with the full ARN of your secret. JSON-key extraction requires a platform version released on or after January 13, 2026. On an earlier supported version, map the whole secret to one environment variable and parse the JSON in the Node.js application, or upgrade the platform first.

The important permission boundary is the Elastic Beanstalk environment's **EC2 instance profile role**, not the role used by the deployment client. Grant that role `secretsmanager:GetSecretValue` only for the required secret ARN. Add `kms:Decrypt` for the KMS key only when the secret uses a customer-managed key. Do not put the secret value in `Dockerrun.aws.json`, the source bundle, or an `.env` file.

One operational detail is easy to miss: rotation does not automatically update the value in already-running application processes. Elastic Beanstalk fetches it during instance bootstrapping. After rotation, trigger `UpdateEnvironment` or `RestartAppServer` to refresh the environment, and make the application tolerate old and new database credentials during a rolling refresh or scale-out.

Official references:

- [Fetching secrets and parameters to Elastic Beanstalk environment variables](https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.secrets.env-vars.html)
- [Required IAM permissions](https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.secrets.IAM-permissions.html)
- [Configuring Elastic Beanstalk Docker environments](https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/create_deploy_docker.container.console.html)
- [Feature release note](https://docs.aws.amazon.com/elasticbeanstalk/latest/relnotes/release-2025-03-31-environment-secrets.html)

How to expose secrets as environment variables in Elastic Beanstalk Docker platform

Add your answer

Relevant content