Skip to main content

Configure multiple Secrets Manager configurations

Multiple Secrets Manager configurations Availability
Self-hosted Edge 3.300 or laterPublic beta
Self-hosted Stable 3.300 or laterPublic beta

You can create multiple Secrets Manager configurations if you need to retrieve secrets from different locations.

Enable the multiple configurations beta​

Multiple configurations for Secrets Manager is currently available in beta. Admins can enable this functionality from the Beta page in your Retool organization's settings.

Create additional configurations​

You configure additional secrets managers using the same configuration as before. You can add multiple configurations for any supported secrets manager provider.

Click Add Secrets Manager and then select the configuration to create. You then provide the required settings based on whether you are configuring AWS, HashiCorp Vault, or Google Cloud Platform.

Each configuration requires a unique string identifier (e.g., vault_2) so that it can be referenced across Retool.

Multiple configurations.

Reference secrets from different configurations​

How you reference secrets with multiple configurations is slightly different once you start using multiple configurations as each configuration's identifier must now also be included in the {{ }} expression.

Reference multiple configurations
{{ secrets['CONFIGURATION_NAME']['KEY_NAME']}}

{{ secrets['gcp_1']['secret3'] }}
{{ secrets['aws_1']['secret3'] }}
{{ secrets['vault_1']['secret3'] }}

Reference secrets from different configurations.

Select a different default configuration​

Once you add a configuration, the previous secrets manager you configured is automatically set as the default. Any existing secrets references that don't include the configuration name are parsed as aliases that point to the default configuration.

For example, if the default configuration is named gcp_1, you can reference a secret named secret_1 using either:

  • {{ secrets['secret_1'] }}
  • {{ secrets['gcp_1']['secret_1'] }}

If necessary, you can select a different configuration to operate as the default from the Secrets Manager settings page. Click to view options for the configuration and set it to the default.

If you change the default configuration to aws_1 but currently use {{ secrets['secret_1'] }}, this would then point to {{ secrets['aws_1']['secret_1'] }}.

Changing the default configuration will cause any existing alias references—without the configuration identifier—to point to the newly select default and potentially break existing usage. Before you make changes, ensure you verify all existing references to secrets so they include the configuration name.