> For the complete documentation index, see [llms.txt](https://mercure-technologies.gitbook.io/expo-open-ota/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mercure-technologies.gitbook.io/expo-open-ota/key-store/aws-secrets-manager.md).

# AWS Secrets Manager

AWS Secrets Manager can hold every secret the server needs: the Expo signing keys, the CloudFront private key, and — in control plane mode — the master key.

### Give the server access to AWS

Before anything else, the server needs to be able to call Secrets Manager. Set the region:

```dotenv
AWS_REGION=your-region
```

For credentials, you have two options:

* **The runtime's IAM role** — if the server runs on AWS (EC2, ECS, EKS…), it picks up the role automatically and there is nothing else to set.
* **An access key pair** — otherwise, provide static credentials:

```dotenv
AWS_ACCESS_KEY_ID=your-access-key-id
AWS_SECRET_ACCESS_KEY=your-secret-access-key
```

Either way, grant the identity `secretsmanager:GetSecretValue` on every secret you reference below. The same credentials are also used for [S3 Storage](/expo-open-ota/storage/s3-storage.md), so a single identity can cover both.

### Stateless mode

Create one secret for each Expo signing key, then point the server at them:

```dotenv
KEYS_STORAGE_TYPE=aws-secrets-manager
AWSSM_EXPO_PUBLIC_KEY_SECRET_ID=name-of-the-public-key-secret
AWSSM_EXPO_PRIVATE_KEY_SECRET_ID=name-of-the-private-key-secret
```

If you use [CloudFront](/expo-open-ota/cdn/cloudfront.md), this mode also reads the CloudFront private key from Secrets Manager — add its secret as well:

```dotenv
AWSSM_CLOUDFRONT_PRIVATE_KEY_SECRET_ID=name-of-the-cloudfront-private-key-secret
```

The other CloudFront key sources are ignored in this mode — see [Keys](/expo-open-ota/key-store/keys.md) for the full rule.

### Control plane mode

Secrets Manager can play three roles here.

**The master key.** Instead of putting the base64 master key in `DB_KEYS_MASTER_KEY_B64`, store it in a secret and reference it:

```dotenv
AWSSM_DB_KEYS_MASTER_KEY_SECRET_ID=name-of-the-master-key-secret
```

Remember that the server expects exactly one of the two master-key variables — setting both, or neither, prevents it from starting.

**The signing keys of an app.** Choose `aws-secrets-manager` when creating the app, and provide the IDs of its existing public and private key secrets. The database then stores no key material for that app — see [Keys](/expo-open-ota/key-store/keys.md) for how the per-app stores work.

**The CloudFront private key.** Set `AWSSM_CLOUDFRONT_PRIVATE_KEY_SECRET_ID`, as in stateless mode. When `KEYS_STORAGE_TYPE` is unset, this secret is the first source tried; if the variable is set, the source it selects wins — the full rule is on [Keys](/expo-open-ota/key-store/keys.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://mercure-technologies.gitbook.io/expo-open-ota/key-store/aws-secrets-manager.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.