PHPackages paeire/laravel-secrets-manager - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [HTTP & Networking](/categories/http) 4. / 5. paeire/laravel-secrets-manager ActiveLibrary[HTTP & Networking](/categories/http) paeire/laravel-secrets-manager ============================== Load AWS Secrets Manager secrets into Laravel's configuration at boot, with optional RDS rotation support and configurable caching. v1.2.1(1mo ago)0843↑186.7%MITPHPPHP ^8.2CI passing Since Jun 4Pushed 1mo agoCompare [ Source](https://github.com/paeire/laravel-secrets-manager)[ Packagist](https://packagist.org/packages/paeire/laravel-secrets-manager)[ RSS](/packages/paeire-laravel-secrets-manager/feed)WikiDiscussions main Synced 2w ago READMEChangelog (1)Dependencies (6)Versions (7)Used By (0) Laravel Secrets Manager ======================= [](#laravel-secrets-manager) Load secrets from [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/) into Laravel's configuration at boot before the database (or anything else) is used. It supports two modes (a general "full config" secret and an RDS rotation secret), configurable caching, and a command to refresh the cache. Requirements ------------ [](#requirements) - PHP 8.2+ - Laravel 10, 11 or 12 - AWS credentials available through the standard [AWS credential provider chain](https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/guide_credentials.html)(IAM role, `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY`, etc.) - The IAM principal needs `secretsmanager:GetSecretValue` on the secret(s) you load. Installation ------------ [](#installation) ``` composer require paeire/laravel-secrets-manager ``` The service provider is auto-discovered. Optionally publish the config: ``` php artisan vendor:publish --tag=secrets-config ``` How it works ------------ [](#how-it-works) Secrets are loaded in the provider's `register()` which runs after Laravel loads its configuration but before any service (database, cache, mail, ...) is resolved. Values are written with `config()->set()`, so they override whatever `config/*.php` produced from `.env`, regardless of when the connection is first used. Configuration ------------- [](#configuration) All settings are driven by environment variables (see `config/secrets.php`): VariableDefaultDescription`FULL_CONFIG``false`Enable the general secret loader.`AWS_SECRET_ID``laravel-prod-secrets`Secret id for the general loader.`AWS_DEFAULT_REGION``us-east-1`AWS region.`RDS_ROTATION``false`Enable the RDS rotation loader.`AWS_SECRET_ID_RDS``laravel-prod-secrets`Secret id for the RDS loader.`RDS_READ_WRITE``false`Mirror the resolved host onto the read/write connection.`SECRETS_THROW_ON_FAILURE``false`Re-throw on load failure instead of only logging.`SECRETS_CACHE``false`Cache the general secret.`SECRETS_CACHE_STORE`*(default store)*Cache store for the general secret.`SECRETS_CACHE_TTL``300`General secret cache TTL (seconds).`SECRETS_RDS_CACHE``false`Cache the RDS secret (off by default).`SECRETS_RDS_CACHE_STORE`*(default store)*Cache store for the RDS secret.`SECRETS_RDS_CACHE_TTL``60`RDS secret cache TTL (seconds).### Mode 1 Full config [](#mode-1-full-config) Set `FULL_CONFIG=true`. Each key in the secret's JSON is applied to the config repository **and** exported to the process environment, so it works whether your code reads it via `config()` or via `env()`: - Keys that are **Laravel config paths** (e.g. `database.connections.mysql.host`) override that config value directly. - Keys that are **flat variable names** (e.g. `RECAPTCHA_SECRET_KEY`) are reachable through `env('RECAPTCHA_SECRET_KEY')` as well as `config('RECAPTCHA_SECRET_KEY')`. ``` { "database.connections.mysql.host": "10.0.0.5", "database.connections.mysql.password": "s3cr3t", "RECAPTCHA_SECRET_KEY": "6Lfz...", "services.stripe.key": "sk_live_..." } ``` > Only scalar values are exported to `env()`; structured (array) values are applied to `config()` only, since environment variables can't hold them. ### Mode 2 RDS rotation [](#mode-2-rds-rotation) Set `RDS_ROTATION=true`. The secret uses the standard AWS RDS rotation shape; only the keys below are mapped onto `database.connections.mysql`, and any extra keys (`engine`, `dbname`, `dbClusterIdentifier`, ...) are ignored: ``` { "username": "admin", "password": "rotated-password", "host": "my-cluster.rds.amazonaws.com", "port": 3306 } ``` With `RDS_READ_WRITE=true`, the resolved host is also written to `database.connections.mysql.read.host` and `...write.host`. Caching ------- [](#caching) General secrets change rarely, so caching avoids an AWS call on every boot. RDS rotation secrets are **not cached by default** on purpose: a cached, rotated password would break authentication. > **Caveat:** if your cache store itself depends on a secret this package loads (for example a Redis password loaded via `FULL_CONFIG`), point `SECRETS_CACHE_STORE` at a self-contained store such as `file`, or leave caching disabled otherwise the cache can't be read before the secret it needs is loaded. ### Refreshing the cache [](#refreshing-the-cache) After rotating or changing a cached secret, clear the cache so it is re-fetched on the next boot: ``` php artisan secrets:refresh # clear both caches php artisan secrets:refresh --general # only the general secret php artisan secrets:refresh --rds # only the RDS secret ``` The command runs in its own process, so it invalidates the cache; the fresh values are loaded on the next request/boot. Failure handling ---------------- [](#failure-handling) By default, a failure to load secrets is logged (without leaking values) and the app continues to boot. Set `SECRETS_THROW_ON_FAILURE=true` to fail fast when secrets are mandatory. Testing ------- [](#testing) ``` composer install composer test ``` License ------- [](#license) MIT ### Health Score 46 — FairBetter than 92% of packages Maintenance93 Actively maintained with recent releases Popularity19 Limited adoption so far Community8 Small or concentrated contributor base Maturity54 Maturing project, gaining track record Bus Factor1 Top contributor holds 88.9% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~81 days Recently: every ~101 days Total 6 Last Release 35d ago PHP version history (2 changes)v1.2.0PHP ^8.1 v1.2.1PHP ^8.2 ### Community Maintainers ![](https://avatars.githubusercontent.com/u/7323066?v=4)[paeire](/maintainers/paeire)[@paeire](https://github.com/paeire) --- Top Contributors [![savalosAdinstra](https://avatars.githubusercontent.com/u/114181079?v=4)](https://github.com/savalosAdinstra "savalosAdinstra (8 commits)")[![paeire](https://avatars.githubusercontent.com/u/7323066?v=4)](https://github.com/paeire "paeire (1 commits)") --- Tags laravelawssecretssecrets-managerrotationrds ### Code Quality TestsPHPUnit ### Embed Badge ![Health badge](/badges/paeire-laravel-secrets-manager/health.svg) ``` [![Health](https://phpackages.com/badges/paeire-laravel-secrets-manager/health.svg)](https://phpackages.com/packages/paeire-laravel-secrets-manager) ``` ### Alternatives [laravel/ai The official AI SDK for Laravel. 1.1k4.6M323](/packages/laravel-ai)[laravel/sail Docker files for running a basic Laravel application. 1.9k212.4M1.5k](/packages/laravel-sail)[laravel/mcp Rapidly build MCP servers for your Laravel applications. 79227.1M229](/packages/laravel-mcp)[propaganistas/laravel-disposable-email Disposable email validator 6023.2M7](/packages/propaganistas-laravel-disposable-email)[tallstackui/tallstackui TallStackUI is a powerful suite of Blade components that elevate your workflow of Livewire applications. 731189.9k16](/packages/tallstackui-tallstackui)[forjedio/inertia-table Backend-driven dynamic tables for Laravel + Inertia.js 272.0k](/packages/forjedio-inertia-table) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)