Skip to content
Lucas Mauro

Type to search…

↑↓ to navigate
Esc

An overview of Doppler for Secrets Management

How does it work? Is it the same as AWS Secrets Manager?

security 2 min read

Doppler is a secrets management platform that acts as a central source of truth for sensitive configuration across our infrastructure. Instead of scattering secrets across Git repositories, environment files, and Kubernetes clusters, we store them in Doppler and let it synchronise them wherever they need to go.

We can think of it as a single vault that pushes secrets to our applications, CI/CD pipelines, cloud providers, and Kubernetes clusters, all from one place.

Managing secrets across different systems is inherently difficult. Secrets can end up scattered across Git repositories, .env files, cloud providers, and orchestration platforms. Each of these systems has its own way of handling secrets.

Doppler exists to give us a single source of truth: we store our secrets once, and it pushes them wherever they need to go, handling encryption, access control, and audit logging in the process.

At a high level, the workflow is:

  1. We store our secrets in a Doppler project (organised by environment: dev, staging, production);
  2. We configure an integration to push those secrets to our target infrastructure;
  3. Doppler handles the syncing, encryption, and access control on our behalf.

Doppler supports a wide range of integrations beyond Kubernetes, including AWS, GCP, Vercel, Heroku, GitHub Actions, and more. This makes it particularly useful when our secrets need to live in multiple places at once.

AWS Secrets Manager is a cloud-native alternative that stores and rotates secrets within the AWS ecosystem. The main differences are:

  • Doppler is cloud-agnostic and syncs secrets to multiple providers (AWS, GCP, Kubernetes, Vercel, and so on) from a single place;
  • AWS Secrets Manager is tightly integrated with AWS services (RDS, Lambda, ECS) and handles automatic rotation natively, but it only works within the AWS ecosystem.

If our infrastructure lives entirely on AWS, Secrets Manager is a solid choice. If we span multiple clouds or need a single source of truth across different platforms, Doppler is the better fit.

Doppler provides role-based access controls (RBAC) that let us define who can view or modify secrets at the project and environment level. This is applied consistently across all integrations, so we don’t need to manage permissions separately in each system.

Comments