0

I'm working on a Laravel application hosted behind a load balancer with multiple instances. Instead of relying solely on the .env file, I'm pulling sensitive configuration values (API keys, DB credentials, etc.) from a cloud secret manager (e.g., AWS Secrets Manager or Google Secret Manager) before the Laravel application fully boots.

What I've done:

I created a custom helper that fetches secrets from the secret manager and stores them in a JSON file under Laravel's storage_path('app/cache/secrets.json').

This helper runs very early in the application lifecycle (before config is loaded) by being included in public/index.php.

Laravel then loads environment values using putenv() and $_ENV from the JSON cache file.

My problem:

If the secret manager updates (e.g., a key is rotated), the JSON file is not automatically updated on each application instance behind the load balancer. This means outdated secrets could persist until a manual deploy or cache clear.

What I'm looking for:

What’s the best way to sync updated secrets across all Laravel instances automatically? (E.g., a mechanism to invalidate or refresh the cache file across the nodes.)

Is there a more Laravel-native or efficient way to load secrets before bootstrapping without using .env files directly on each node?

Would it be better to use Laravel’s config caching and merge in secrets dynamically? Or would that defeat the purpose of immutable secrets?

Notes:

I'm open to solutions that involve Laravel events, queues, cron jobs, or system-level sync strategies.

I'm currently using Laravel 10.

Any insights or best practices for handling this securely and efficiently would be greatly appreciated!

Improve this question
2
  • not sure I understand, when an server instance is built, you have no secret loaded yet? only when the first request arrives does you 'helper' check it has no cache and requests the secrets? If there are not ENV secrets on server, how does your helper know to auth and request them? Commented Jun 12 at 15:50
  • 1
    In Laravel the dotenv library will load environment configuration from a .env file unless the same variables are already in the environment. I know you can load secrets from the aws secrets manager to a container environment using ECS and I think you can also do the same with EC2 instances using userdata . It's not clear if any of these would work for you. If not you can always just use the AWS SDK and not environment configuration Commented Jun 12 at 16:36
Related questions
1
How does a local docker container load secrets from AWS Secret Manager?
3
How is AWS Secrets Manager used in an Elastic Beanstalk application safe if the AWS_SECRET_KEY has to be stored in the EBS environment vars?
0
spring boot + load secret manager secrets from different AWS account
Load 5 more related questions Show fewer related questions

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.