@lockzero/aws-sync

@lockzero/aws-sync

Bidirectional sync between LockZero and AWS Secrets Manager / SSM Parameter Store.

Installation

npm install -g @lockzero/aws-sync
# or as a dev dependency
npm install --save-dev @lockzero/aws-sync

Authentication

Credential	How to provide
LockZero API key	--lz-key <key> or LOCKZERO_API_KEY env var
AWS credentials	Standard AWS SDK chain: env vars, ~/.aws/credentials, OIDC, instance profile

Commands

push — LockZero → AWS

# Push the "openai" namespace to SSM Parameter Store
lockzero-aws push --namespace openai --backend ssm --prefix /lockzero/

# Push to Secrets Manager instead
lockzero-aws push --namespace openai --backend secretsmanager --prefix /lockzero/

# Preview without writing
lockzero-aws push --namespace openai --backend ssm --prefix /lockzero/ --dry-run

SSM parameters are created as SecureString at path <prefix><namespace>/<fieldKey>.
Secrets Manager stores all fields as a JSON blob in one secret named <prefix><namespace>.

pull — AWS → LockZero

# Pull SSM parameters back into LockZero
lockzero-aws pull --namespace openai --backend ssm --prefix /lockzero/

# Preview without writing
lockzero-aws pull --namespace openai --backend ssm --prefix /lockzero/ --dry-run

diff — show what would change

# Show what a push would do
lockzero-aws diff --namespace openai --backend ssm --prefix /lockzero/ --direction push

# Show what a pull would do
lockzero-aws diff --namespace openai --backend ssm --prefix /lockzero/ --direction pull

Output is color-coded: green + = add, yellow ~ = update, red - = orphan, gray = = unchanged.

GitHub Actions

See src/examples/sync-workflow.yml for a complete CI workflow using OIDC (no static AWS keys needed).

Options

Flag	Default	Description
--namespace	required	LockZero namespace (e.g. openai, stripe)
--backend	ssm	ssm or secretsmanager
--prefix	/lockzero/	Path prefix for AWS parameters/secrets
--lz-key	env	LockZero API key
--lz-base-url	https://api.lockzero.io	LockZero base URL
--region	env	AWS region
--dry-run	false	Preview changes without writing