AWS secrets,
straight from your terminal.
A fast, parallelized TUI for managing SSM Parameter Store and
ECS Task Definitions. Pull secrets into clean, grouped
.env files — or push them back — without leaving the keyboard.
Self-updating · single binary · self-contained .hexyn-aws/ directory
Features
Everything you need to move secrets
Interactive TUI
A polished Bubble Tea interface. Search lists, switch regions, and confirm actions — all from the keyboard.
Task Definition sync
Discover the exact secrets an ECS service uses and resolve every valueFrom to a real value automatically.
Smart prefix grouping
Secrets are split into separate .env files by their SSM path — global.env, service.env — so shared and app config stay clean.
Sorted & de-duplicated
Every generated file is alphabetised and de-duped, with //secureString markers preserved for safe round-trips.
Multi-region & login
Auto-discover enabled regions and switch instantly. Handle temporary AWS tokens with the built-in login screen.
One-command updates
Stay current with hexyn-aws update. Native binaries for AMD64 & ARM64 on every platform.
How it works
From cluster to .env in three steps
Pick a service
Choose a region, ECS cluster, and service from searchable, fully-paginated lists.
Choose how to pull
From Task Definition for the exact secrets a service runs with, or By Path Prefix for everything under a path.
Get grouped files
Decide the output folder and receive sorted, prefix-grouped .env files plus a raw tdf-secrets.json.
Installation
Up and running in seconds
curl -fsSL https://flockyn.github.io/hexyn-aws/install.sh | bash
iwr https://flockyn.github.io/hexyn-aws/install.ps1 | iex
The installer downloads a single self-contained binary and sets up your .hexyn-aws/ directory. Prefer manual installs? Grab a build from the releases page.
Changelog
What's new
Pulled live from the latest GitHub releases.
FAQ
Questions, answered
Which operating systems are supported? +
Native binaries for Linux (AMD64/ARM64), macOS (Intel/Apple Silicon), and Windows (AMD64). Every install is fully self-contained.
How do I update to the latest version? +
Update directly from the CLI:
hexyn-aws update
Or simply re-run the installation command above.
Where are my files and credentials stored? +
Everything lives in a self-contained .hexyn-aws/ directory — credentials, plus input/ and output/ folders for the .env files you push and pull.