This repository contains the third-party AWS providers linked from the koanf README:
- AWS Secrets Manager
- AWS Systems Manager Parameter Store
Both providers implement the github.com/knadh/koanf/v2.Provider interface,
use AWS SDK for Go v2, support the AWS default credential chain, and can poll
for version changes. Go 1.24 or newer is required.
go get github.com/defensestation/koanf/providers/secretsmanager
go get github.com/defensestation/koanf/providers/parameterstoreRead() loads a value directly as a koanf configuration map. Provide a
delimiter and transform function when the AWS name should become a nested
configuration path.
ReadBytes() returns the raw value. Pass a koanf parser to Load() when a
parameter or secret contains structured JSON, YAML, or another supported
format:
k := koanf.New(".")
err := k.Load(provider, json.Parser())Secrets Manager supports both SecretString and SecretBinary. Parameter
Store supports String, StringList, and SecureString; set
WithDecryption on ssm.GetParameterInput when decrypted SecureString values
are required.
Provider uses config.LoadDefaultConfig and accepts AWS load options through
Config.LoadOptions. ProviderWithClient accepts an existing AWS client,
which is useful for applications with shared clients and for tests.
The AWS input and per-request option fields are exposed directly, so provider users can select versions, labels or stages and configure SDK behavior without this repository duplicating AWS APIs.
Call Watch to poll for version changes and Unwatch to stop. Parameter Store
defaults to a ten-minute polling interval and Secrets Manager defaults to one
hour. Set WatchInterval to override these defaults.
A Secrets Manager input with a fixed VersionId cannot be watched because a
pinned version never changes. Use the default AWSCURRENT stage or set
VersionStage instead.
Likewise, a Parameter Store Name pinned to a numeric version will not emit
changes. Use an unversioned name or a label that is moved between versions.
The provider constructors now return (provider, error) so AWS configuration
failures are visible. AWS request fields moved into Config.Input, key
callbacks moved into Config.TransformFunc, and explicit AWS configuration is
provided with Config.LoadOptions or ProviderWithClient.
The old Type: "map" switch is replaced by ReadBytes() and a koanf parser.
This supports any koanf parser instead of coupling the providers to JSON.
See the complete runnable examples: