Encrypted environment file

An environment’s variables must fit in the function’s environment, which is small (4 KB on AWS Lambda). An application with more can keep them in Laravel’s encrypted environment file instead, so only its key has to be set on the platform.

Setting it up

1. Encrypt the environment’s variables, naming the SKE environment with --env:

   php artisan env:encrypt --env=production

   This writes .env.production.encrypted from .env.production and prints the key. Commit the encrypted file. Every .env.*.encrypted file ships in the image, and every other .env file is left out. Only the deployed environment’s file is decrypted, with that environment’s key.

2. Set LARAVEL_ENV_ENCRYPTION_KEY to the printed key, as a secret of that environment.

How it is loaded

On the platform, the bridge decrypts the file with Laravel’s own Encrypter when the PHP process starts, before Laravel reads its environment, so config/*.php sees the values. A variable that is already set is never overridden: the values the platform sets (APP_URL, DB_*, REDIS_*, SQS_*, …) and the environment’s secrets win over the file. See Environment variables for the full order.

• Without the key, or without the file, nothing is loaded.
• A key that can’t decrypt the file stops the application with Could not decrypt .env.{environment}.encrypted with LARAVEL_ENV_ENCRYPTION_KEY, logged to the platform’s log.
• Both formats env:encrypt writes are read, with and without --readable. The file must use the default cipher, AES-256-CBC.