feat: update Flowise encryption key handling to use AWS Secrets Manager - #534
Merged
Conversation
…er (#533) ## Title feat: update Flowise encryption key handling to use AWS Secrets Manager ## Description ### Motivation & Scope Refactors Flowise’s encryption key configuration to use AWS Secrets Manager instead of a filesystem path. While conceptually small, this change improves security posture and standardizes secret management. Motivation inferred from diff: security and environment isolation. ### Major Changes - **copilot/copilot.appName.env.template** - Removed `SECRETKEY_PATH=/var/efs/`. - Updated documentation comments to describe Secrets Manager–based configuration: - Variables: `SECRETKEY_STORAGE_TYPE=aws`, `SECRETKEY_AWS_REGION`, `SECRETKEY_AWS_NAME`. - Notes per-environment isolation and warns that key changes invalidate credentials. - Retained `FLOWISE_SECRETKEY_OVERWRITE` as an advanced override option. - **copilot/environments/addons/flowise-encryption-key.yml** *(new)* - Adds CloudFormation resource to generate a secret in AWS Secrets Manager. - Outputs secret **Name**, **Arn**, and **Region** for consumption by the service. - **copilot/flowise/addons/flowise-secrets-manager-access-policy.yml** - Clarified description and metadata. - Adjusted IAM policy to reference env-specific secret ARN `${App}-${Env}-FlowiseEncryptionKey-*`. - Allows actions `GetSecretValue`, `CreateSecret`, and `DescribeSecret`. - **copilot/flowise/manifest.yml** - Injects new environment variables to reference the secret via CFN outputs. - Sets `count: 2` to scale Flowise service. ### Expected Impact - More secure and isolated management of Flowise encryption keys. - Simplified deployment: keys automatically provisioned and injected via env vars. - Slight capacity increase from scaling to two tasks. ### Breaking Changes & Migrations - **Encryption Key Migration:** Credentials encrypted with the old filesystem key will be invalid unless migrated. Existing encrypted values may need re-entry. - No API or schema changes apparent. ### Env/Config Changes - Introduces a new CloudFormation addon for secret provisioning. - Requires updated manifest variables (`SECRETKEY_STORAGE_TYPE`, `SECRETKEY_AWS_REGION`, `SECRETKEY_AWS_NAME`). - `FLOWISE_SECRETKEY_OVERWRITE` remains as an override option. ### Testing Notes - Deploy to staging to confirm service can read secrets correctly. - Verify encrypted credentials behavior post-migration. - Check app startup with missing or rotated secrets. - Validate scaling to `count: 2` functions as expected. ### Related Issues/Links - None referenced in the diff.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
maxtechera
temporarily deployed
to
staging - theanswer-iek0
September 11, 2025 02:31 — with 
Render
Inactive
Render
Inactive
|
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Title
feat: update Flowise encryption key handling to use AWS Secrets Manager
Description
Motivation & Scope
Refactors Flowise’s encryption key configuration to use AWS Secrets Manager instead of a filesystem path. While conceptually small, this change improves security posture and standardizes secret management. Motivation inferred from diff: security and environment isolation.
Major Changes
copilot/copilot.appName.env.template
SECRETKEY_PATH=/var/efs/.SECRETKEY_STORAGE_TYPE=aws,SECRETKEY_AWS_REGION,SECRETKEY_AWS_NAME.FLOWISE_SECRETKEY_OVERWRITEas an advanced override option.copilot/environments/addons/flowise-encryption-key.yml (new)
copilot/flowise/addons/flowise-secrets-manager-access-policy.yml
${App}-${Env}-FlowiseEncryptionKey-*.GetSecretValue,CreateSecret, andDescribeSecret.copilot/flowise/manifest.yml
count: 2to scale Flowise service.Expected Impact
Breaking Changes & Migrations
Env/Config Changes
SECRETKEY_STORAGE_TYPE,SECRETKEY_AWS_REGION,SECRETKEY_AWS_NAME).FLOWISE_SECRETKEY_OVERWRITEremains as an override option.Testing Notes
count: 2functions as expected.Related Issues/Links