AWS Secrets Manager — Bruno v4 Integration

Premium feature: AWS Secrets Manager integration requires a Bruno Pro or Ultimate license. View Bruno pricing.

This collection demonstrates how to retrieve AWS Secrets Manager values in Bruno v4 without hardcoding credentials or secrets in requests.

What changed in Bruno v4?

• Secret mappings moved from Collection → Secrets to Environment → External Secrets.
• Configuration is stored in each environment file under externalSecrets; Bruno no longer reads the collection-level secrets.json.
• The recommended request-field syntax is {{secret-name.key-name}}.
• The legacy {{$secrets.secret-name.key-name}} syntax still works in v4, but is deprecated and will be removed in the next major release.

Prerequisites

• Bruno v4 with a Pro or Ultimate license
• An AWS account with a secret stored in AWS Secrets Manager
• An environment selected in Bruno, such as local
• AWS credentials or an AWS CLI profile with permission to read the secret

At minimum, grant secretsmanager:GetSecretValue. Listing or browsing secrets may require additional permissions such as secretsmanager:ListSecrets.

Step 1 — Create an AWS secret

1. Open AWS Secrets Manager in the AWS Console.

2. Create or open a secret containing key/value data, for example:

   {
     "username": "bruno",
     "password": "replace-with-a-secret",
     "access_key": "topsecret",
     "version": "v4"
   }

3. Copy either its exact Secret name or full ARN.

4. Note the AWS Region that contains the secret, such as us-east-1.

Step 2 — Add the AWS account in Bruno

1. Open Preferences → Secrets Manager.
2. Click + Add Secret Manager.
3. Select AWS Secrets Manager.
4. Enter an account name, such as Product Server.
5. Choose an authentication mode:
   • Manual: enter the Access Key ID, Secret Access Key, optional Session Token, and Region.
   • AWS CLI: use credentials from your configured AWS CLI profile.
6. Click Test Connection.
7. Click Save.

The Session Token is required only for temporary credentials or an assumed role. Prefer short-lived credentials or an AWS CLI profile over long-lived access keys.

Step 3 — Configure External Secrets for an environment

Starting in v4, this configuration belongs to an environment rather than the collection.

1. Select the environment from the environment selector.
2. Open the environment editor.
3. Go to External Secrets.
4. Select AWS Secrets Manager.
5. Select the AWS account created in Step 2.
6. Add a mapping:
   • Name: secret
   • AWS Secret Name / ARN: the exact secret name or ARN
   • Enabled: on
7. Save the environment.

The equivalent environment YAML is:

name: local
variables:
  - name: baseURL
    value: https://echo.usebruno.com
externalSecrets:
  type: aws-secrets-manager
  variables:
    - name: secret
      secretName: arn:aws:secretsmanager:us-east-1:123456789012:secret:prod/usebruno
      enabled: true

You can replace the ARN with a short secret name. Each Bruno environment has its own externalSecrets block, allowing development, staging, and production to use different AWS accounts, Regions, or secrets.

Step 4 — Fetch secrets

1. Open Environment → External Secrets.
2. Click Fetch Secrets in the top-right corner.
3. Verify that keys such as access_key, username, password, and version appear in the Secret Keys column.

Fetching again replaces the currently fetched values.

Use secrets in requests

External secrets can be referenced in request URLs, headers, query parameters, bodies, and authentication fields.

Recommended Bruno v4 syntax

{
  "name": "usebruno",
  "msg": "The most loving API client for developers",
  "apiKey": "{{secret.access_key}}"
}

The pattern is:

{{<secret-name>.<key-name>}}

Legacy syntax

This still resolves in Bruno v4, but is deprecated:

{{$secrets.secret.access_key}}

Bruno underlines legacy references in the editor. Update them before the next major release.

Pre-request and post-request scripts

The script API remains unchanged:

const apiKey = bru.getSecretVar('secret.access_key');
req.setHeader('Authorization', 'Bearer ' + apiKey);

Migrating an existing pre-v4 collection

1. Ensure secrets.json is writable.
2. Open the collection in the Bruno v4 app.
3. Bruno automatically migrates the mappings into the relevant environment file.
4. Verify them under Environment → External Secrets.
5. Replace {{$secrets.name.key}} references with {{name.key}}.
6. Commit the updated environment file.
7. After verification, delete the obsolete secrets.json.

The Bruno CLI does not auto-migrate. Open the collection in the app before running it through the CLI or CI.

CLI and CI

Export the account from Preferences → Secrets Manager as a .env file, or create one containing:

BRUNO_AWS_ACCESS_KEY_ID=your-access-key-id
BRUNO_AWS_SECRET_ACCESS_KEY=your-secret-access-key
BRUNO_AWS_SESSION_TOKEN=your-session-token
BRUNO_AWS_REGION=us-east-1

BRUNO_AWS_SESSION_TOKEN is optional unless temporary credentials are used. When BRUNO_AWS_* variables are absent, Bruno falls back to the standard AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, and AWS_REGION variables.

Run the collection with:

bru run collection/ --env local --secrets-env-file ./secrets.env

Credential files contain plain-text credentials. Add them to .gitignore and never commit them.

Further reading

• Bruno v4 Secret Manager migration guide
• Add an AWS Secrets Manager provider
• Configure and fetch AWS secrets
• Use AWS secrets
• Secret Managers in Bruno CLI