A CLI and GitHub Action that securely centralizes your environment variables from AWS SSM or Azure Key Vault as a single source of truth
Automate .env and secret management with Envilder
Streamline your environment setup with AWS SSM Parameter Store or Azure Key Vault
Envilder is a CLI tool for .env automation, cloud secrets management, and secure environment variable sync. Generating and maintaining consistent .env files is a real pain point for any development team. From outdated secrets to insecure practices, the risks are tangible. Envilder eliminates these pitfalls by centralizing and automating secret management across real-world environments (dev, test, production) in a simple, secure, and efficient way. Use Envilder to automate .env files, sync secrets with AWS SSM Parameter Store or Azure Key Vault, and streamline onboarding and CI/CD workflows.
aws or azure with the --provider flag.env and your cloud provider--profile flag for multi-account setups🛠 Requirements:
ssm:GetParameter, ssm:PutParameter$config.vaultUrl in your map file or --vault-url flagpnpm add -g envilder
Or use your preferred package manager:
npm install -g envilder
💡 Want to try without installing? Run
npx envilder --helpto explore the CLI instantly.💡 New to AWS SSM? AWS Systems Manager Parameter Store provides secure storage for configuration data and secrets:
💡 New to Azure Key Vault? Azure Key Vault safeguards cryptographic keys and secrets used by cloud apps:
Use Envilder directly in your CI/CD workflows with our official GitHub Action:
AWS SSM (default):
- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@v5
with:
role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
aws-region: us-east-1
- name: Pull secrets from AWS SSM
uses: macalbert/envilder/github-action@v0.8.0
with:
map-file: param-map.json
env-file: .env
Azure Key Vault:
- name: Azure Login
uses: azure/login@v2
with:
client-id: ${{ secrets.AZURE_CLIENT_ID }}
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
- name: Pull secrets from Azure Key Vault
uses: macalbert/envilder/github-action@v0.8.0
with:
map-file: param-map.json
env-file: .env
provider: azure
vault-url: ${{ secrets.AZURE_KEY_VAULT_URL }}
📖 View full GitHub Action documentation
Watch how easy it is to automate your .env management in less than 1 minute:
After configuring your cloud provider credentials, you can begin managing your secrets.
Create a mapping file:
{
"DB_PASSWORD": "/my-app/db/password"
}
Push a secret to AWS SSM:
envilder --push --key=DB_PASSWORD --value=12345 --secret-path=/my-app/db/password
Generate your .env file from AWS SSM:
envilder --map=param-map.json --envfile=.env
Add $config to your mapping file:
{
"$config": {
"provider": "azure",
"vaultUrl": "https://my-vault.vault.azure.net"
},
"DB_PASSWORD": "my-app-db-password"
}
Pull secrets from Azure Key Vault:
envilder --map=param-map.json --envfile=.env
Or use CLI flags to override:
envilder --provider=azure --vault-url=https://my-vault.vault.azure.net --map=param-map.json --envfile=.env
Your secrets are now managed and versioned from your cloud provider. Add .env to your .gitignore for security.
Envilder is designed for automation, onboarding, and secure cloud-native workflows.
The mapping file (param-map.json) is the core of Envilder. It maps environment variable names to secret paths
in your cloud provider. You can optionally include a $config section to declare which provider and settings to use.
When no $config is present, Envilder defaults to AWS SSM Parameter Store:
{
"API_KEY": "/myapp/prod/api-key",
"DB_PASSWORD": "/myapp/prod/db-password",
"SECRET_TOKEN": "/myapp/prod/secret-token"
}
Values are SSM parameter paths (e.g., /myapp/prod/api-key).
$config (explicit provider)Add a $config key to declare the provider and its settings. Envilder reads $config for configuration
and uses all other keys as secret mappings:
AWS SSM with profile:
{
"$config": {
"provider": "aws",
"profile": "prod-account"
},
"API_KEY": "/myapp/prod/api-key",
"DB_PASSWORD": "/myapp/prod/db-password"
}
Azure Key Vault:
{
"$config": {
"provider": "azure",
"vaultUrl": "https://my-vault.vault.azure.net"
},
"API_KEY": "myapp-prod-api-key",
"DB_PASSWORD": "myapp-prod-db-password"
}
Azure naming: Key Vault secret names only allow alphanumeric characters and hyphens. Envilder automatically normalizes names — slashes and underscores become hyphens (e.g.,
/myapp/db/password→myapp-db-password).
$config Options| Key | Type | Default | Description |
|---|---|---|---|
provider | "aws" | "azure" | "aws" | Cloud provider to use |
vaultUrl | string | — | Azure Key Vault URL (required when provider is "azure") |
profile | string | — | AWS CLI profile for multi-account setups (AWS only) |
CLI flags and GitHub Action inputs always override $config values:
CLI flags / GHA inputs > $config in map file > defaults (AWS)
This means you can set a default provider in $config and override it per invocation:
# Uses $config from the map file
envilder --map=param-map.json --envfile=.env
# Overrides provider and vault URL from the map file
envilder --provider=azure --vault-url=https://other-vault.vault.azure.net --map=param-map.json --envfile=.env
graph LR
A["Mapping File (param-map.json)"] --> B[Envilder]:::core
C["Environment File (.env or --key)"] --> B
D["Cloud Credentials (AWS or Azure)"]:::cloud --> B
E["AWS SSM / Azure Key Vault"]:::cloud --> B
B --> F["Pull/Push Secrets"]
classDef cloud fill:#ffcc66,color:#000000,stroke:#333,stroke-width:1.5px;
classDef core fill:#1f3b57,color:#fff,stroke:#ccc,stroke-width:2px;
{"DB_PASSWORD": "/myapp/db/password"}.env file: envilder --map=param-map.json --envfile=.envenvilder --push --map=param-map.json --envfile=.env--provider=azure to switch from the default AWS providerQ: What is Envilder?
A: Envilder is a CLI tool for automating .env and secret management using AWS SSM Parameter Store or Azure Key Vault.
Q: Which cloud providers are supported?
A: AWS SSM Parameter Store (default) and Azure Key Vault. Use --provider=azure to switch providers.
Q: How does Envilder improve security?
A: Secrets are never stored in code or shared via chat/email. All secrets are managed and synced securely via your
cloud provider.
Q: Can I use Envilder in CI/CD pipelines?
A: Yes! Use the official Envilder GitHub Action to pull secrets directly
in your workflows — no extra setup needed.
Q: Does Envilder support multiple AWS profiles?
A: Yes, you can use the --profile flag to select different AWS credentials.
Q: How do I configure Azure Key Vault?
A: Add a $config section to your map file with "provider": "azure" and "vaultUrl": "https://my-vault.vault.azure.net",
or use --provider=azure --vault-url=https://my-vault.vault.azure.net CLI flags. Authentication uses Azure
Default Credentials (Azure CLI, managed identity, etc.).
Q: What environments does Envilder support?
A: Any environment supported by your cloud provider—dev, test, staging, production, etc.
Q: Is Envilder open source?
A: Yes, licensed under MIT.
Envilder is not a secrets manager. It is a deterministic projection layer from cloud secret
stores into .env files. It does not store secrets, does not require a backend, and integrates
cleanly into CI/CD pipelines.
To make a fair comparison, it's important to separate tools by what they actually do:
These tools manage secrets as data and project them into .env or runtime:
| Feature | Envilder | dotenv-vault | infisical |
|---|---|---|---|
| Source of truth | External (SSM / Key Vault) | dotenv vault (SaaS) | Infisical backend |
| Sync direction | Bidirectional | Pull only | Bidirectional |
| Declarative mapping | ✅ JSON mapping | ❌ | ❌ |
| Multi-provider (AWS + Azure) | ✅ | ❌ | ⚠️ (primarily its own backend) |
Local .env generation | ✅ | ✅ | ✅ |
| CI/CD integration | ✅ Native GitHub Action | Manual | ✅ Native |
| Requires SaaS | ❌ | ✅ | Optional |
| Self-hosted | N/A (no server needed) | ❌ | ✅ |
| Complexity | Low | Low | Medium |
| Vendor lock-in | Low | High | Medium |
| Open source | ✅ MIT | Partial | ✅ |
These tools serve different purposes and are better seen as complements, not competitors:
| Tool | Purpose | Manages app secrets? | Works with .env? |
|---|---|---|---|
| chamber | Injects SSM params at runtime (exec with env) | ❌ | ❌ |
| aws-vault | Safely assumes AWS IAM roles / STS credentials | ❌ | ❌ |
.env sync? → dotenv-vaultIf you already use AWS SSM or Azure Key Vault and want a lightweight, zero-infrastructure CLI
that generates .env files from a declarative JSON mapping — without a SaaS dependency or extra
servers — Envilder is the simplest path.
Envilder also brings unique strengths in determinism and testability:
param-map.json lives in source control, making secret
projections reproducible across environmentsEnvilder generates .env files on disk. This is ideal for:
For production runtime, container orchestrators (ECS, Kubernetes) and platform services
(Vercel, Fly.io) can inject secrets directly as environment variables — no .env file needed.
In those cases, prefer native secret injection over writing secrets to disk.
Coming soon: An
--execmode is planned to inject secrets directly into a child process without writing to disk (e.g.,envilder exec -- node server.js). See the Roadmap.
We're continuously improving Envilder based on community feedback. Upcoming features include:
👉 View full roadmap with priorities
All help is welcome — PRs, issues, ideas!
MIT © Marçal Albert
See LICENSE | CHANGELOG | Security Policy
FAQs
A CLI and GitHub Action that securely centralizes your environment variables from AWS SSM or Azure Key Vault as a single source of truth
The npm package envilder receives a total of 989 weekly downloads. As such, envilder popularity was classified as not popular.
We found that envilder demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.