Hiding Rails Credentials

Question

I have a Rails 6 application. In my credentials file, I have both development and production API keys. I want to be able to hide the production API keys since some developers don't need access to the credentials.

In previous versions of Rails, I could grab an environment variable using <%= ENV["MY_VAR"] %> and place that in the secrets.yml file. However, Rails credentials doesn't support executing Ruby in the yml file which makes sense because it's encrypted but this now puts limitations on the ability to prevent other developers from accessing production API keys. Is there anyway around this without hardcoding ENV["MY_VAR"] throughout the Rails app? Here is ultimately what I want to accomplish within my credentials file.

development:
    aws: 11111111
production:
    aws: <%= ENV["AWS_SECRET"] %>

Answer 1

You can generate credential file per environment

rails credentials:edit --environment development

rails credentials:edit --environment production

This will create the credentials file config/credentials/development.yml.enc and config/credentials/production.yml.enc , and encryption keys config/credentials/development.key , config/credentials/production.key

So you can share development key with other developers without need to share production.key

Checkout this commit for more details: https://github.com/rails/rails/pull/33521