Secrets (SSM Parameter Store)

v1 secrets live in SSM Parameter Store SecureString — not AWS Secrets Manager (that may come later if we need it).

Naming

/utopia/{project}/{env}/{name}

Example: project demo, env dev, name api-key → /utopia/demo/dev/api-key.

Commands

Command	Purpose
create secret	Create SecureString + utopia tags
secret set	Upsert value
secret get	Read (redacted unless --reveal)
list	Includes secrets with COST_UNAVAILABLE
destroy secret	Delete after ownership check

Safety

• Never log or print values on create/set/destroy success
• secret get redacts by default; --reveal required for plaintext
• Same destroy ownership model as buckets (--force escape)

awsutopia create secret api-key --value '…'
awsutopia secret get api-key
awsutopia secret set api-key 'rotated'
awsutopia destroy secret api-key --yes