Skip to main content

atmos secret init

Walk the declared secrets for a stack and interactively initialize or rotate them. With --stack alone, the whole stack is provisioned: stack-scoped secrets once each plus every instance's instance-scoped secrets. With --component, only that instance is provisioned. Missing secrets are prompted with masked input; already-initialized secrets prompt to update (rotate) or skip — making init an easy way to rotate secrets manually. --force rotates them all without asking. Provide --input FILE, or redirect standard input, to initialize declared values from a dotenv file non-interactively. Lines beginning with # and unquoted inline # comments are ignored. Unknown keys warn by default; use --mode=strict to reject them before anything is written.

atmos secret init --help

Usage​

atmos secret init [flags]

--stack is required (prompted on a TTY when omitted) unless you use --all; --component is optional — omit it to provision the entire stack. Use --all to provision every declared secret across every stack. See Secret scopes.

Examples​

# Provision the whole stack (stack-scoped secrets + every instance's instance-scoped secrets)
atmos secret init --stack=prod

# Provision every declared secret instance in every stack
atmos secret init --all

# Provision just one instance, prompting for each missing secret
atmos secret init --stack=prod --component=api

# Re-prompt for and overwrite secrets that are already initialized
atmos secret init --stack=prod --component=api --force

# Preview what would be initialized without prompting or writing
atmos secret init --stack=prod --component=api --dry-run

# Disambiguate a component that exists in multiple types
atmos secret init --stack=prod --component=api --type=terraform

# Provision using a specific identity for the backend
atmos secret init --stack=prod --component=api --identity=aws/prod-secrets

# Initialize values from a dotenv file (or use: atmos secret init ... < .env.local)
atmos secret init --input .env.local --stack=prod --component=api

# Reject unknown dotenv keys instead of warning and skipping them
atmos secret init --input .env.local --mode=strict --stack=prod --component=api

Arguments​

n/a
No positional arguments.

Flags​

--stack (alias -s)

The Atmos stack to operate on. Required.

Environment variable: ATMOS_STACK

--all

Provision declared secrets across every stack. Cannot be combined with --stack or --component.

--component (alias -c)

The Atmos component whose declared secrets are provisioned. Required.

Environment variable: ATMOS_COMPONENT

--type

The component type (terraform, helmfile, packer, or ansible). Used to disambiguate when a component name exists in more than one type.

--identity (alias -i)

The identity to use when accessing the secret backend.

Environment variable: ATMOS_IDENTITY

--force (alias -f)

Re-prompt for and overwrite secrets that are already initialized. Without this flag, already-initialized secrets are skipped.

--dry-run

Show which secrets would be initialized without prompting for values or writing anything to the backend.

--input

Read dotenv NAME=VALUE entries from a file. Use - for stdin. When omitted, redirected standard input is read automatically.

--mode

Handling for dotenv keys that are not declared by the selected component(s): warn (default) warns and skips them; strict returns an error before writing.

See Also​