# Secure env variables

**URL:** <https://forum.buildkite.community/t/secure-env-variables/454>\
**Category:** General\
**Created:** [April 25, 2019, 1:09pm UTC](https://forum.buildkite.community/t/secure-env-variables/454 "2019-04-25T13:09:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mr\_green](https://avatars.discourse-cdn.com/v4/letter/m/aca169/32.png) [@mr\_green](https://forum.buildkite.community/u/mr_green)\
**Post date:** [April 25, 2019, 1:09pm UTC](https://forum.buildkite.community/t/secure-env-variables/454/1 "2019-04-25T13:09:37Z")

</div>

I’ve got a few environment variables that I’m setting on the pipeline:

```auto
env:
  AWS_ACCESS_KEY_ID: "xyzxyzxyzxyzxyzxyzxyzxyz"
  AWS_SECRET_ACCESS_KEY: "xyzxyzxyzxyzxyzxyzxyzxyzxyzxyz"

steps:
  - command: 
      - "echo Hello World"

```

Does buildkite have any way to secure those environment variables, or integration to something like AWS Secrets Manager?

---

<div class="post-metadata">

**Author:** ![moensch](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.buildkite.community/moensch/32/33_2.png) [@moensch](https://forum.buildkite.community/u/moensch)\
**Post date:** [April 26, 2019, 5:24am UTC](https://forum.buildkite.community/t/secure-env-variables/454/2 "2019-04-26T05:24:26Z")

</div>

I would write a repository-level `environment` or `pre-command` hook, fetch the secrets from AWS Secrets Manager or SSM Parameter Store, and export them as env vars.

> **[Buildkite Agent Hooks (v3)](https://buildkite.com/docs/agent/v3/hooks#repository-hooks)**
>
> Automate your team’s software development processes, from testing through to delivery, no matter the language, environment or toolchain.