# Secrets and access

> Inject API keys through SSM Parameter Store, and reach the instance through Session Manager or Tailscale.

## API keys and secrets

`env_vars` maps environment variable names to SSM parameters. A `null` value
makes the module create a placeholder for you to fill in; a path references
an existing parameter. The secret values stay in Parameter Store; Terraform
state holds only the parameter names.

```hcl
module "workspace" {
  source  = "douklar/agent-workspace/aws"
  version = "~> 2.0"

  env_vars = {
    ANTHROPIC_API_KEY = null               # placeholder, fill in after apply
    GITHUB_TOKEN      = null
    SHARED_SECRET     = "/team/shared-key" # existing parameter
  }
}
```

After apply, write each placeholder:

```bash
aws ssm put-parameter \
  --name "/workspace/extra-environment-variables/ANTHROPIC_API_KEY" \
  --type SecureString --value "..." --overwrite --region eu-central-1
```

The instance loads the variables at shell start. Replace `workspace` with your
`name_prefix` if you changed it.

## Developer tooling

| Setting | Default |
|---|---|
| `install_vscode` | `true` |
| `enable_tailscale` | `true` |
| `install_claude_code` | `true` |
| `install_codex_cli` | `false` |

Set these inside `developer_config`.

## Access

| Method | What it is | Needs |
|---|---|---|
| AWS Session Manager | Terminal in the browser or CLI, authenticated by IAM | IAM permissions |
| Tailscale | Encrypted peer-to-peer mesh VPN | An auth key written to SSM |

No SSH keys and no inbound ports are needed.

### Tailscale

```bash
aws ssm put-parameter --name "/workspace/tailscale-auth-key" \
  --type SecureString --value "tskey-auth-..." --overwrite --region eu-central-1
```

Restart Tailscale on the instance (or reboot) to join your tailnet. The
module's README includes an ACL that restricts access to Tailscale admins.

## Encryption

EBS, SSM parameters, SQS and the S3 export bucket are encrypted by default
with AWS-managed keys. Set `kms_key_arn` to use your own key for all of them
and for CloudWatch Logs.

Source: https://douklar.app/docs/agent-workspace/secrets-and-access (Agent Workspace docs, last checked 2026-10-17)