> For the complete documentation index, see [llms.txt](https://docs.release.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.release.com/reference-documentation/environment-settings/environment-specific-environment-variables/secrets.md).

# Secrets vaults

Importing secrets from external secrets managers

You can import environment variables from Release Secrets Manager, AWS Secrets Manager, AWS Systems Manager Parameter Store (SSM), and GCP Secret Manager using the format `$secrets.<provider abbreviation>.<secret_name>` for the value. The key and secret will follow the same variable schema as any other secret environment variable:

```
key:
  type: String
  description: Env variable name
  required: true
value:
  type: String
  description: Representation of the value to be fetched. $secrets.<provider_abbreviation>.<secret_name> format. If secret is true, and this field is omitted, will use previously saved value.
  required: true (but hidden if secret)
secret:
  type: Boolean
  description: Value is secret and should be encrypted and not visible in the UI when viewing
  required: false, but required for secrets manager imports
```

Here are the provider abbreviations:

| Provider                            | Provider Abbreviation |
| ----------------------------------- | --------------------- |
| Release Secrets Manager             | rsm                   |
| AWS Secrets Manager                 | aws                   |
| AWS Systems Manager Parameter Store | ssm                   |
| GCP Secret Manager                  | gcp                   |

If you are an AWS GovCloud user, contact us to enable beta access.

## Referencing cloud secrets

Navigate to the Settings page and click the **Edit** button to modify the "Environment Variables" file. Paste the formatted value into the "Environment Variables" file, following the schema requirements. Ensure you set `secret` to `true` and choose a unique key value.

<pre class="language-yaml"><code class="lang-yaml">- key: TEST_SSM
  value: $secrets.ssm.test
  secret: true
- key: TEST_AWS
  value: $secrets.aws.test
  secret: true
- key: TEST_GCP
  value: $secrets.gcp.test
  secret: true
- key: TEST_RELEASE
<strong>  value: $secrets.rsm.test
</strong><strong>  secret: true
</strong></code></pre>

Release will fetch and encode the values of the secrets before applying them.

{% hint style="danger" %}
**Caution:** To reset the fetched value, you must redeploy. An updated value in an external secrets manager will not update the stored encoded value.
{% endhint %}

### Copying referenced secrets

{% hint style="info" %}
Rather than formatting the value manually, you can copy the value from the Secrets page.
{% endhint %}

Navigate to **Configuration** -> **Secrets**. Select a secrets provider tab. Additional dropdowns for cloud integration and region will appear if relevant. Only cloud integrations with running clusters will be displayed in the dropdown for GCP, AWS, and SSM.

Click the copy icon to copy the formatted value.

![Copy a secret](https://585411240-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M1neGLLQ0sDXeK6ooSo%2Fuploads%2Fgit-blob-f8086fa7ee820fdf67b525b273b86c2347f34f14%2Fcopy-secret.png?alt=media)

## Creating Release secrets

Navigate to **Configuration** -> **Secrets**. Select the Release tab. Click **Create Release Secret**.

![Create a secret](https://585411240-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M1neGLLQ0sDXeK6ooSo%2Fuploads%2Fgit-blob-d51ca7b0080823a331040fedb3ea4951685e4f40%2Fcreate.png?alt=media)

Fill out the key and value, then click the `✔`.

![Create a secret](https://585411240-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M1neGLLQ0sDXeK6ooSo%2Fuploads%2Fgit-blob-960f24a4cb883cb5ef5af450a666379bf78cdede%2Fkey-value.png?alt=media)

## Creating AWS secrets

Navigate to **Configuration** -> **Secrets**. Select the AWS logo from the dropdown menu. Additional dropdown menus for cloud integration and region will appear if relevant. Click **+ Create AWS Secret**.

<figure><img src="https://585411240-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M1neGLLQ0sDXeK6ooSo%2Fuploads%2Fgit-blob-9acad73a764736d9edc22c613e6a701d93e89526%2Fimage.png?alt=media" alt=""><figcaption><p>Two buttons appear if AWS secrets and SSM parameters are available for your account.</p></figcaption></figure>

Fill out the **Key/Name**, **Value**, and **Description** fields. Click **Create Secret**. A success or error message will appear. Any parameter created here will have the tag `{"created\_by" : "release"}`.

<figure><img src="https://585411240-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M1neGLLQ0sDXeK6ooSo%2Fuploads%2Fgit-blob-298d3f1006caa816ba371366cfdd2f6f5141cd20%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

## Creating AWS Systems Manager Parameter Store parameters

Navigate to **Configuration** -> **Secrets**. Select the AWS logo from the dropdown menu. Additional dropdown menus for cloud integration and region will appear if relevant. Click **+ Create SSM Parameter**. Fill out the **Key/Name** and **Value** fields. Select a type from String, StringList, or SecureString.

<figure><img src="https://585411240-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M1neGLLQ0sDXeK6ooSo%2Fuploads%2Fgit-blob-326523294cc58a4034a6025909bd386e28dab516%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Click **Save**. A success or error message will appear. Any parameter created here will have the tag `{"created\_by" : "release"}`.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.release.com/reference-documentation/environment-settings/environment-specific-environment-variables/secrets.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.