Secrets and access

Inject API keys through SSM Parameter Store, and reach the instance through Session Manager or Tailscale.

API keys and secrets

env_vars maps environment variable names to SSM parameters. A null value makes the module create a placeholder for you to fill in; a path references an existing parameter. The secret values stay in Parameter Store; Terraform state holds only the parameter names.

module "workspace" {
  source  = "douklar/agent-workspace/aws"
  version = "~> 2.0"

  env_vars = {
    ANTHROPIC_API_KEY = null               # placeholder, fill in after apply
    GITHUB_TOKEN      = null
    SHARED_SECRET     = "/team/shared-key" # existing parameter
  }
}

After apply, write each placeholder:

aws ssm put-parameter \
  --name "/workspace/extra-environment-variables/ANTHROPIC_API_KEY" \
  --type SecureString --value "..." --overwrite --region eu-central-1

The instance loads the variables at shell start. Replace workspace with your name_prefix if you changed it.

Developer tooling

Setting	Default
`install_vscode`	`true`
`enable_tailscale`	`true`
`install_claude_code`	`true`
`install_codex_cli`	`false`

Set these inside developer_config.

Access

Method	What it is	Needs
AWS Session Manager	Terminal in the browser or CLI, authenticated by IAM	IAM permissions
Tailscale	Encrypted peer-to-peer mesh VPN	An auth key written to SSM

No SSH keys and no inbound ports are needed.

Tailscale

aws ssm put-parameter --name "/workspace/tailscale-auth-key" \
  --type SecureString --value "tskey-auth-..." --overwrite --region eu-central-1

Restart Tailscale on the instance (or reboot) to join your tailnet. The module's README includes an ACL that restricts access to Tailscale admins.

Encryption

EBS, SSM parameters, SQS and the S3 export bucket are encrypted by default with AWS-managed keys. Set kms_key_arn to use your own key for all of them and for CloudWatch Logs.

Count this visit?