-
Notifications
You must be signed in to change notification settings - Fork 2.1k
Support Expiry/Deletion of sst/passphrase/* Parameters on Stack Removal #5617
Description
Yes, an LLM wrote this. You can see the original discussion here
Description:
In certain environments (e.g. ephemeral or PR deployments), the accumulation of sst/passphrase/* parameters becomes unnecessary after stack removal. These parameters are used to encrypt state, but once the stack is removed, retaining them isn't always needed—especially if we don’t intend to recover the state.
Feature request:
Provide a way to clean up sst/passphrase/* parameters on stack removal. Ideally, this could be done via an opt-out flag in the home config, e.g.:
home: {
provider: "aws",
deletePassphraseOnRemove: input.stage !== "prod", // default false
}Alternative ideas discussed:
- A dedicated CLI command (e.g. sst purge --stage pr-1234) to fully clean up a stage, including parameter store entries and files in S3.
- A simple script to delete the key after a remove, as a manual workaround.
Concerns:
Some caution is required, as automatic deletion may be risky if misconfigured. A user noted the potential danger of accidentally deleting passphrases for the wrong environment.