README
¶
Syncret
Syncret reacts to secret rotation and change events and automates two follow-up actions: propagating selected fields into a dependent secret, and forcing running services to restart with the latest values.
It ships as a minimal container image and runs as a serverless function triggered by your cloud provider's event system.
The problem
When a secret rotates or changes, dependent secrets and running services need to react. Most teams solve this with untested, one-off glue code that never gets reused. Syncret standardizes that pattern into a single, configurable binary that covers the two most common follow-up actions.
How it works
flowchart LR
S["Secret store\n(secret rotates or changes)"]
E["Event system\n(change notification)"]
Sy[Syncret]
TS["Propagate to\ndependent secret\n— optional —"]
CS["Restart\ndependent services\n— optional —"]
S --> E --> Sy
Sy --> TS
Sy --> CS
At least one of the two actions must be configured — they can also run together.
See How it works for the full design.
Provider support
| Provider | Secret store | Event trigger | Compute |
|---|---|---|---|
| AWS ✓ | Secrets Manager | EventBridge (CloudTrail) | ECS |
| Azure | Key Vault | Event Grid | Container Apps / ACI |
| GCP | Secret Manager | Pub/Sub | Cloud Run |
Azure and GCP support is planned. Contributions welcome.
Quickstart — AWS
Set environment variables on your Lambda function and deploy the container image.
SYNCRET_PROVIDER=aws
# Required — identifies which secret triggers Syncret
SYNCRET_AWS_SECRET_ARN=arn:aws:secretsmanager:us-east-1:123456789012:secret:my-secret-AbCdEf
SYNCRET_AWS_REGION=us-east-1
# Action 1 — propagate fields to a dependent secret (optional)
SYNCRET_AWS_TARGET_SECRET_ARN=arn:aws:secretsmanager:us-east-1:123456789012:secret:my-app-secret-XyZaBc
SYNCRET_TARGET_SECRET_KEYS=password # or: password:DB_PASS (src:dst remapping)
# Action 2 — restart ECS services (optional)
SYNCRET_AWS_ECS_FORCE_DEPLOY=true
SYNCRET_AWS_ECS_CLUSTER=my-cluster
SYNCRET_AWS_ECS_SERVICES=backend,worker
# Notification context (optional)
SYNCRET_INSTANCE_NAME="V4 Production"
SYNCRET_TIMEZONE=America/Lima
SYNCRET_GCHAT_WEBHOOK="https://chat.googleapis.com/v1/spaces/SPACE/messages?key=KEY&token=TOKEN"
At least one action (SYNCRET_AWS_TARGET_SECRET_ARN or SYNCRET_AWS_ECS_FORCE_DEPLOY=true) must be set or Syncret will refuse to start.
→ Full reference
→ Step-by-step deployment guide
Building from source
make build # build binary (output: bin/syncret)
make test # run tests with race detector
make cover # run tests and show per-function coverage breakdown
make lint # run golangci-lint
make tidy # go mod tidy
make docker-build # build multi-arch image (linux/amd64 + linux/arm64)
Requires Go 1.27+.
License
Apache 2.0 — see LICENSE.
Directories