Skip to content

Support Expiry/Deletion of sst/passphrase/* Parameters on Stack Removal #5617

@isaac-scarrott

Description

@isaac-scarrott

Yes, an LLM wrote this. You can see the original discussion here

Description:

In certain environments (e.g. ephemeral or PR deployments), the accumulation of sst/passphrase/* parameters becomes unnecessary after stack removal. These parameters are used to encrypt state, but once the stack is removed, retaining them isn't always needed—especially if we don’t intend to recover the state.

Feature request:

Provide a way to clean up sst/passphrase/* parameters on stack removal. Ideally, this could be done via an opt-out flag in the home config, e.g.:

home: {
  provider: "aws",
  deletePassphraseOnRemove: input.stage !== "prod", // default false
}

Alternative ideas discussed:

  • A dedicated CLI command (e.g. sst purge --stage pr-1234) to fully clean up a stage, including parameter store entries and files in S3.
  • A simple script to delete the key after a remove, as a manual workaround.

Concerns:
Some caution is required, as automatic deletion may be risky if misconfigured. A user noted the potential danger of accidentally deleting passphrases for the wrong environment.

Metadata

Metadata

Labels

No labels
No labels

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions