AWS Secrets Manager

aws secretsmanager create-secret \
  --name "authscape/production" \
  --secret-string '{
    "ConnectionStrings__DefaultConnection": "Server=...",
    "AppSettings__Stripe__SecretKey": "sk_live_xxx"
  }'

dotnet add package AWSSDK.SecretsManager
dotnet add package Amazon.Extensions.Configuration.SystemsManager

using Amazon;
using Amazon.SecretsManager;
using Amazon.SecretsManager.Model;

var builder = WebApplication.CreateBuilder(args);

if (!builder.Environment.IsDevelopment())
{
    await LoadAwsSecrets(builder.Configuration);
}

async Task LoadAwsSecrets(IConfigurationBuilder config)
{
    var client = new AmazonSecretsManagerClient(RegionEndpoint.USEast1);

    var request = new GetSecretValueRequest
    {
        SecretId = "authscape/production"
    };

    var response = await client.GetSecretValueAsync(request);
    var secrets = JsonSerializer.Deserialize<Dictionary<string, string>>(response.SecretString);

    config.AddInMemoryCollection(secrets);
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetSecretValue"
      ],
      "Resource": "arn:aws:secretsmanager:us-east-1:123456789:secret:authscape/*"
    }
  ]
}

{
  "taskRoleArn": "arn:aws:iam::123456789:role/authscape-task-role",
  "containerDefinitions": [
    {
      "secrets": [
        {
          "name": "ConnectionStrings__DefaultConnection",
          "valueFrom": "arn:aws:secretsmanager:us-east-1:123456789:secret:authscape/production:ConnectionStrings__DefaultConnection::"
        }
      ]
    }
  ]
}