Skip to main content

atmos secret set

Set the value of a declared secret in its configured backend (create or update). The value can be supplied inline as NAME=VALUE, piped in with --stdin, or entered through an interactive masked prompt when the command runs in a terminal with no value provided. With no NAME (and no --stack/--component) in a terminal, Atmos walks you through choosing the stack, component, and secret. This command is also available under the add alias.

atmos secret set --help

Usage​

atmos secret set [NAME[=VALUE]] [flags]

Setting a secret is scope-aware. Atmos normally requires the component that declares the secret. For a named secret declared with scope: global, you may omit --component; Atmos discovers a declaration-bearing component in the selected stack because the component does not affect the global backend coordinate. Instance- and stack-scoped secrets still require --component. See Secret scopes.

String values are written verbatim to secret stores. This makes values written by atmos secret set round-trip through !secret NAME | raw without JSON quote characters being added. Structured maps and lists supplied through other store APIs remain JSON encoded. Values written by an older Atmos release may already contain JSON quotes; set those values again with the current release to normalize them.

Examples​

# Walk through stack → component → secret → value interactively (terminal only)
atmos secret set

# Set a value inline
atmos secret set SERVICE_API_KEY=abc123 --stack=prod --component=example-service

# Set a value interactively with a masked prompt (terminal only)
atmos secret set SERVICE_API_KEY --stack=prod --component=example-service

# Read a multi-line value (such as a PEM key) from standard input
cat key.pem | atmos secret set APP_PRIVATE_KEY --stdin --stack=prod --component=example-service

# A global declaration does not require a component
atmos secret set SHARED_API_KEY=abc123 --stack=prod

# Overwrite an existing value without confirmation
atmos secret set SERVICE_API_KEY=newvalue --stack=prod --component=example-service --force

# Use the `add` alias
atmos secret add SERVICE_API_KEY=abc123 --stack=prod --component=example-service

Arguments​

NAME[=VALUE]

The name of the declared secret to set, optionally with an inline value. When =VALUE is omitted, the value is read from --stdin or from an interactive masked prompt.

Flags​

--stack (alias -s)

The Atmos stack to operate on. Required — prompted interactively on a TTY when omitted.

Environment variable: ATMOS_STACK

--component (alias -c)

The Atmos component that declares the secret. Required except when a positional secret name resolves to a consistent scope: global declaration in the selected stack. Prompted interactively on a TTY when no name is supplied.

Environment variable: ATMOS_COMPONENT

--type

The component type (terraform, helmfile, packer, or ansible). Used to disambiguate when a component name exists in more than one type.

--identity (alias -i)

The identity to use when accessing the secret backend.

Environment variable: ATMOS_IDENTITY

--stdin

Read the secret value from standard input. Useful for piping multi-line values such as certificates or private keys.

--force (alias -f)

Overwrite an existing value without prompting for confirmation.

See Also​