parley

Git-style env sync between your machine and AWS Parameter Store + KMS. A self-hosted alternative to Doppler/Infisical for AWS-native teams.

parley treats environment variables like source code: push, pull, diff. The store is your own AWS account (SSM Parameter Store, encrypted by KMS). No SaaS subscription, no third-party vault. Works great in TS monorepos.

Why parley

• AWS-native, IAM-bound — secrets live in your account; access is governed by your existing IAM/SSO policies.
• Git-style workflow — parley push / pull / diff map cleanly to how you already think.
• Monorepo-aware — first-class apps × profiles matrix in a typed parley.config.ts.
• Ephemeral injection — parley run --app api --profile production -- node server.js (no disk writes).
• CI-friendly — parley diff --exit-code fails the build when local and remote drift.

Install

pnpm add -D @coldsurf/parley
# or
npm i -D @coldsurf/parley

Quickstart

# 1. Generate a parley.config.ts at repo root
pnpm parley init

# 2. Edit prefix / region / kmsKeyId / apps mappings
# 3. Validate AWS credentials and KMS/IAM
pnpm parley doctor

# 4. Push your local .env.<profile> → SSM
pnpm parley push api production

# 5. Pull from SSM → local .env.<profile>
pnpm parley pull api production

Commands

Command	Description
init	Scaffold parley.config.ts, sanity-check AWS credentials
push	Local .env.<profile> → SSM (changes only)
pull	SSM → local .env.<profile>
diff	Compare keys between local and remote (values hashed)
list	List SSM keys for an app/profile
get / set / unset	Single-key operations
run -- <cmd>	Inject env from SSM and exec a command (no disk writes)
`sync push	pull`
doctor	Diagnose credentials, SSM access, KMS access, mappings

Configuration

// parley.config.ts
import { defineConfig } from '@coldsurf/parley/config';

export default defineConfig({
  region: 'ap-northeast-2',
  prefix: '/myorg/myproject',
  kmsKeyId: 'alias/parley',
  apps: {
    api: { path: 'apps/api', profiles: ['development', 'staging', 'production'] },
    web: { path: 'apps/web', profiles: ['development', 'production'] },
  },
});

Comparison

	parley	chamber	Doppler / Infisical	sops
Backend	AWS SSM + KMS	AWS SSM + KMS	SaaS	File (any backend)
Self-hosted	✅	✅	Paid plan	✅
TS DX	✅	❌ (Go)	✅	❌
push/pull/diff	✅	partial	✅	partial
Monorepo apps × profiles	✅	❌	partial	❌

License

MIT © COLDSURF