# Environment variables set in S3 not accessible from build step

**URL:** <https://forum.buildkite.community/t/environment-variables-set-in-s3-not-accessible-from-build-step/3547>\
**Category:** Elastic CI Stack for AWS\
**Created:** [February 11, 2024, 8:39pm UTC](https://forum.buildkite.community/t/environment-variables-set-in-s3-not-accessible-from-build-step/3547 "2024-02-11T20:39:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ldev654](https://avatars.discourse-cdn.com/v4/letter/l/3e96dc/32.png) [@ldev654](https://forum.buildkite.community/u/ldev654)\
**Post date:** [February 11, 2024, 8:39pm UTC](https://forum.buildkite.community/t/environment-variables-set-in-s3-not-accessible-from-build-step/3547/1 "2024-02-11T20:39:57Z")

</div>

Hello,

I have setup the AWS CI stack and have got it all working (as well as adding an “environment” file in the secrets S3 bucket). However, although I can see in the build logs “Fixing permissions …” it says the var was added, example “MY\_KEY added”, it is not accessible from a build step which is running a script.

I have managed to do a workaround which adds an empty env var to my pipeline.yaml and this works as in it gets overrided with the value defined in the s3 file, but I feel like I shouldn’t need to do this and that all secrets/vars added in the environment file should be accessible.

```auto
env:
  MY_KEY: ""

```

Is there something I am doing wrong, or extra I need to do? Here’s the pipeline.yaml

```auto
common:
  docker-login: &dockerLogin
    docker-login#v3.0.0:
      propagate-environment: true
      mount-buildkite-agent: true
      username: "n/a"
      password-env: ACCESS_TOKEN
      server: registry-link
      volumes:
        - "/var/run/docker.sock:/var/run/docker.sock"

env:
  IMAGE_TAG: "${BUILDKITE_BRANCH}_${BUILDKITE_BUILD_NUMBER}"
  MY_KEY_EXAMPLE: "" 

steps:
  - label: ":docker: Build & Push to Registry"
    key: build_push
    command: .buildkite/scripts/build-push.sh
    plugins:
      - *dockerLogin
  - label: ":k8s: Deploy to Kubernetes"
    depends_on: build_push
    # Added /bin/bash as a workaround for now, since normally it fails (perm denied).
    command: /bin/bash .buildkite/scripts/deploy-helm.sh
    plugins:
      - *dockerLogin
      - docker#v3.0.0:
          image: my-registry/helm-helpers:0.1.0
          propagate-environment: true
          always-pull: true

```

---

<div class="post-metadata">

**Author:** ![james.s](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.buildkite.community/james.s/32/1305_2.png) [@james.s](https://forum.buildkite.community/u/james.s)\
**Post date:** [February 11, 2024, 10:10pm UTC](https://forum.buildkite.community/t/environment-variables-set-in-s3-not-accessible-from-build-step/3547/2 "2024-02-11T22:10:11Z")

</div>

Hey @ldev654!

Hope you’re well; great question too 🙂

Since you’re using the Elastic Stack - first premise was whether you were using its’ managed secret S3 bucket; which you are using here. Since the `export`ed variables are placed in each _job_ of your pipeline - you’ll want to evaluate these added variables at runtime with `$$` in particular (i.e in your case; `$$MY_KEY_EXAMPLE`.

You wouldn’t need to set a top level env either with the above too!

---

<div class="post-metadata">

**Author:** ![ldev654](https://avatars.discourse-cdn.com/v4/letter/l/3e96dc/32.png) [@ldev654](https://forum.buildkite.community/u/ldev654)\
**Post date:** [February 12, 2024, 2:12pm UTC](https://forum.buildkite.community/t/environment-variables-set-in-s3-not-accessible-from-build-step/3547/3 "2024-02-12T14:12:41Z")

</div>

Hi @james.s

Thank you for your reply. I have tried doing this using $$ before the env variable, however it does not evaluate to anything. When I try `echo $$DO_ACCESS_TOKEN` from my sh script, it just outputs “7DO\_ACCESS\_TOKEN” & then of course this fails in below commands that try to use this auth token variable since it is not resolving to the value.

(DO\_ACCESS\_TOKEN is the env variable)

 ![Screenshot 2024-02-12 at 14.13.22](https://us1.discourse-cdn.com/flex016/uploads/buildkite1/original/2X/8/807f249049b3860093dcf1b0da5e6ed813f2fab0.png)

Is this approach able to work from a sh script?

---

<div class="post-metadata">

**Author:** ![stephanie.atte](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.buildkite.community/stephanie.atte/32/1357_2.png) [@stephanie.atte](https://forum.buildkite.community/u/stephanie.atte)\
**Post date:** [February 12, 2024, 6:59pm UTC](https://forum.buildkite.community/t/environment-variables-set-in-s3-not-accessible-from-build-step/3547/4 "2024-02-12T18:59:34Z")

</div>

Hello @ldev654,

Appreciate the update.

Could you please forward a link to the build to [support@buildkite.com](mailto:support@buildkite.com)? This will help us examine it further.

Cheers!