suve

A Git-like CLI/TUI/GUI for AWS Parameter Store / Secrets Manager, Google Cloud Secret Manager, and Azure Key Vault / App Configuration. Familiar commands like show, log, diff, and a staging workflow for safe, reviewable changes.

Installation

[!NOTE] On Linux, suve requires GTK3 and WebKit2GTK for GUI support. Use the CLI/TUI-only version if you don't need the desktop GUI. The keyboard-driven TUI (--tui) is pure Go and ships in every build, including the CLI/TUI-only one — only the desktop GUI (--gui) needs the GTK3/WebKit2GTK dependencies.

Using mise (macOS/Linux/Windows)

suve is installable directly from GitHub Releases via mise's github backend — no extra registry required:

# Full version (CLI/TUI + GUI)
mise use -g "github:mpyw/suve"

# CLI/TUI-only version (no GUI dependencies, recommended for Linux. Not available on macOS/Windows)
mise use -g "github:mpyw/suve[matching=cli]"

[!TIP] Committing to a shared mise.toml used across OSes? Use a single cross-platform rule instead:

[tools]
"github:mpyw/suve" = { version = "latest", matching_regex = "(darwin|windows|cli_[0-9.]+_linux)" }

Using aqua (macOS/Linux/Windows)

suve is available in the standard aqua registry:

aqua g -i mpyw/suve

The registry picks the right asset per platform automatically: the self-contained GUI build on macOS/Windows, and the dependency-free CLI/TUI-only static build on Linux (so --gui is not available via aqua on Linux).

Using Homebrew (macOS/Linux)

# Full version (CLI/TUI + GUI)
brew install mpyw/tap/suve

# CLI/TUI-only version (no GUI dependencies, recommended for Linux)
brew install mpyw/tap/suve-cli

Using Scoop (Windows)

scoop bucket add mpyw https://github.com/mpyw/scoop-bucket.git
scoop install suve

Using npm (macOS/Linux/Windows)

# Global install
npm install -g @mpyw/suve

# Or run without installing
npx @mpyw/suve --version

The right prebuilt binary is pulled in automatically per platform: the self-contained GUI build on macOS/Windows, and the dependency-free CLI/TUI-only static build on Linux (so --gui is not available via npm on Linux).

[!TIP] Ideal for cloud shells. AWS CloudShell, Google Cloud Shell, and Azure Cloud Shell all ship Node.js, so npx @mpyw/suve … runs suve with nothing to download or install — and the dependency-free CLI/TUI-only build is exactly what you want there (no GUI). Each shell's ambient credentials are auto-detected too; see Cloud Shell support.

No package manager? Install the latest release straight from GitHub Releases with whichever downloader your host already has:

# curl
curl -fsSL https://raw.githubusercontent.com/mpyw/suve/main/scripts/install.sh | sh

# wget
wget -qO- https://raw.githubusercontent.com/mpyw/suve/main/scripts/install.sh | sh

The script detects your OS and CPU architecture, downloads the matching release asset over HTTPS, verifies its SHA-256 against the release's checksums.txt, and installs the suve binary to /usr/local/bin (using sudo if that directory needs elevation, or falling back to ~/.local/bin when no sudo is available). On Linux it auto-selects the build: the GUI build when a system WebKit2GTK (4.1 or 4.0) is detected, otherwise the dependency-free CLI/TUI-only static build.

Everything below is optional — pick the line you want (swap curl -fsSL for wget -qO- if that's what you have):

BASE=https://raw.githubusercontent.com/mpyw/suve/main/scripts/install.sh

curl -fsSL "$BASE" | VERSION=0.0.0 sh                        # pin a specific version
curl -fsSL "$BASE" | sh -s -- --cli                          # force CLI/TUI-only
curl -fsSL "$BASE" | sh -s -- --gui                          # force the GUI build
curl -fsSL "$BASE" | SUVE_INSTALL_DIR="$HOME/.local/bin" sh  # install to a custom dir
curl -fsSL "$BASE" | sh -s -- --deb                          # native .deb via apt (Debian/Ubuntu)
curl -fsSL "$BASE" | sh -s -- --rpm                          # native .rpm via dnf (Fedora/RHEL)

--deb / --rpm install a native package instead of a bare binary — tracked by apt/dnf for clean upgrade/removal, with GUI dependencies resolved for you. They also default to auto (GUI when WebKit2GTK is already present, else CLI-only); add --gui/--cli to force a build.

[!TIP] Prefer to read before you run? Download, inspect, then execute:

curl -fsSLO https://raw.githubusercontent.com/mpyw/suve/main/scripts/install.sh
less install.sh && sh install.sh

Prefer to do it by hand? The --deb / --rpm flags above are just a wrapper around downloading the package from GitHub Releases and handing it to your package manager:

Debian/Ubuntu (.deb):

export VERSION=0.0.0
export ARCH=amd64  # or arm64
export WEBKIT_SUFFIX=""  # use "_webkit2_41" for Ubuntu 24.04+

# CLI/TUI-only (recommended, no GUI dependencies)
curl -LO "https://github.com/mpyw/suve/releases/download/v${VERSION}/suve-cli_${VERSION}-1_${ARCH}.deb"
sudo apt install "./suve-cli_${VERSION}-1_${ARCH}.deb"

# Full version (CLI/TUI + GUI; apt resolves GTK3 and WebKit2GTK)
curl -LO "https://github.com/mpyw/suve/releases/download/v${VERSION}/suve${WEBKIT_SUFFIX}_${VERSION}-1_${ARCH}.deb"
sudo apt install "./suve${WEBKIT_SUFFIX}_${VERSION}-1_${ARCH}.deb"

Note: Ubuntu 22.04/Debian uses webkit2gtk-4.0 (default). Ubuntu 24.04+ uses webkit2gtk-4.1 (set WEBKIT_SUFFIX="_webkit2_41").

Red Hat/Fedora (.rpm):

export VERSION=0.0.0
export ARCH=x86_64  # or aarch64
export WEBKIT_SUFFIX=""  # use "_webkit2_41" for Fedora 40+

# CLI/TUI-only (recommended, no GUI dependencies)
curl -LO "https://github.com/mpyw/suve/releases/download/v${VERSION}/suve-cli-${VERSION}-1.${ARCH}.rpm"
sudo dnf install "./suve-cli-${VERSION}-1.${ARCH}.rpm"

# Full version (CLI/TUI + GUI; dnf resolves GTK3 and WebKit2GTK)
curl -LO "https://github.com/mpyw/suve/releases/download/v${VERSION}/suve${WEBKIT_SUFFIX}-${VERSION}-1.${ARCH}.rpm"
sudo dnf install "./suve${WEBKIT_SUFFIX}-${VERSION}-1.${ARCH}.rpm"

Note: Fedora 39 and earlier uses webkit2gtk-4.0 (default). Fedora 40+ uses webkit2gtk-4.1 (set WEBKIT_SUFFIX="_webkit2_41").

go install github.com/mpyw/suve/cmd/suve@latest

Note: go install builds the CLI/TUI only. The desktop GUI requires pre-built assets that are not included in the Go module. For GUI support, use a package manager or build from source.

# Add to go.mod as a tool dependency
go get -tool github.com/mpyw/suve/cmd/suve@latest

# Run via go tool
go tool suve param show /my/param

For platforms without pre-built packages (e.g., Arch Linux) or if you need the latest development version with GUI:

Requires Go 1.27+.

git clone https://github.com/mpyw/suve.git
cd suve

CLI/TUI only:

mise build-cli
# Binary: bin/suve

CLI/TUI + GUI (requires Node.js for the frontend build):

mise build-gui
# Binary: bin/suve  (run `suve --gui`)

Build dependencies for GUI:

Platform	Dependencies
All	Node.js (for frontend build)
macOS	Xcode Command Line Tools
Windows	WebView2 Runtime (usually pre-installed)

Linux requires GTK3 and WebKit2GTK:

Platform	Dependencies
Ubuntu 22.04/Debian	sudo apt install libgtk-3-dev libwebkit2gtk-4.0-dev
Ubuntu 24.04+	sudo apt install libgtk-3-dev libwebkit2gtk-4.1-dev
Fedora 39	sudo dnf install gtk3-devel webkit2gtk4.0-devel
Fedora 40+	sudo dnf install gtk3-devel webkit2gtk4.1-devel
Arch Linux	sudo pacman -S gtk3 webkit2gtk-4.1

For webkit2gtk-4.1 (Ubuntu 24.04+, Fedora 40+, Arch Linux), add the webkit2_41 build tag via SUVE_GUI_TAGS:

SUVE_GUI_TAGS=production,webkit2_41 mise build-gui

Features

• Git-like commands: show, log, diff, ls, tag
• Staging workflow: edit → status → diff → apply (review changes before applying), plus export / import for portable, per-service snapshots
• Version navigation: #VERSION, ~SHIFT, :LABEL syntax
• Colored diff output: Easy-to-read unified diff format
• Multi-cloud: AWS SSM Parameter Store / Secrets Manager, Google Cloud Secret Manager, and Azure Key Vault / App Configuration
• Secure staging: Working staging state is encrypted at rest with a data key stored in the OS keychain (override with SUVE_STAGING_KEY). Each encrypted file is bound to its scope and service, so a file moved to another scope or service fails to decrypt, and an unencrypted file found while a key is configured is reported with a warning. When no key is available (no keychain backend and no SUVE_STAGING_KEY), an interactive session falls back to plaintext with a warning, while a non-interactive one refuses to write unencrypted unless SUVE_STAGING_ALLOW_PLAINTEXT is set. Exported snapshot files carry a separately passphrase-encrypted payload (Argon2 + AES-GCM; an empty passphrase writes plaintext).
• TUI mode: Keyboard-driven terminal UI via --tui flag (built with Bubble Tea); ships in every build, including the dependency-free CLI/TUI-only one

Metadata Terminology

suve uses AWS-friendly terms and maps each backend's native concept onto three axes. Mind two naming traps: Google Cloud "labels" are suve tags (key=value metadata), and Azure App Configuration's "label" is suve's namespace (an identity axis, --namespace/--ns) — neither is the other.

Backend	suve tag(tag/untag)	suve :LABEL(version selector)	suve description(--description)	suve namespace(--namespace)
AWS Parameter Store	resource tags	—	resource description	—
AWS Secrets Manager	resource tags	version staging labels (AWSCURRENT / AWSPREVIOUS / custom)	resource description	—
Google Cloud Secret Manager	resource labels	—	resource annotation: description=...	—
Azure Key Vault	tags on a specific version	—	—	—
Azure App Configuration	tags on a specific version	—	—	label — the (key, label) composite address (unset = empty string, or dev / prd / …)

All key=value metadata is unified as tags; suve adds no per-provider command or flag aliases. For the App Configuration label axis, see Namespaces.

Shell Completion

suve can generate completion scripts for bash, zsh, fish, and PowerShell. Source the output to enable completion for commands, subcommands, and flags.

# bash — add to ~/.bashrc
source <(suve completion bash)

# zsh — add to ~/.zshrc
source <(suve completion zsh)

# fish
suve completion fish > ~/.config/fish/completions/suve.fish

# PowerShell — add to $PROFILE
suve completion pwsh | Out-String | Invoke-Expression

Authentication & Scopes

suve talks to each cloud's data plane using that cloud's own SDK credential chain — the same one the native CLI (aws / gcloud / az) uses. There is nothing suve-specific to configure: sign in the normal way, then point suve at the resource with an environment variable (or the equivalent flag).

aws sso login \
  --profile prod

export AWS_PROFILE=prod
export AWS_REGION=us-east-1

gcloud auth \
  application-default \
  login

export GOOGLE_CLOUD_PROJECT=my-project

az login

# secret
export AZURE_KEYVAULT_NAME=my-vault
# param
export AZURE_APPCONFIG_NAME=my-store

[!NOTE]

• Every value has a flag equivalent: --profile/--region, --project, --vault-name/--store-name.
• AWS — the standard credential chain: SSO, static keys, ~/.aws/credentials, or an IAM role.
  • With aws-vault: aws-vault exec prod -- suve param show /my/param.
• Google Cloud — Application Default Credentials; or a service-account key via GOOGLE_APPLICATION_CREDENTIALS.
• Azure — the DefaultAzureCredential chain; or a service principal via AZURE_CLIENT_ID / AZURE_CLIENT_SECRET / AZURE_TENANT_ID.
  • az login sets no environment variables — it caches credentials under ~/.azure, which suve reuses.
  • The Key Vault / App Configuration name is a globally-unique endpoint, so no subscription or resource group is needed.

AWS Configuration

suve uses standard AWS SDK configuration:

Authentication (in order of precedence):

1. Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN)
2. Shared credentials file (~/.aws/credentials) and config (~/.aws/config)
   • Use AWS_PROFILE to specify which profile to load (default: default)
3. IAM role (EC2, ECS, Lambda)

Region:

• AWS_REGION or AWS_DEFAULT_REGION environment variable
• ~/.aws/config file

[!WARNING] Ensure your IAM role/user has appropriate permissions:

• SSM: ssm:GetParameter, ssm:GetParameters, ssm:GetParameterHistory, ssm:PutParameter, ssm:DeleteParameter, ssm:DescribeParameters, ssm:AddTagsToResource, ssm:RemoveTagsFromResource
• SM: secretsmanager:GetSecretValue, secretsmanager:DescribeSecret, secretsmanager:ListSecretVersionIds, secretsmanager:ListSecrets, secretsmanager:CreateSecret (new secrets only), secretsmanager:UpdateSecret, secretsmanager:DeleteSecret, secretsmanager:RestoreSecret, secretsmanager:TagResource, secretsmanager:UntagResource

Google Cloud Configuration

Scope	Flag	Environment variable
Project	--project	GOOGLE_CLOUD_PROJECT

Credentials come from Application Default Credentials — set up locally with gcloud auth application-default login, or point at a service-account key with GOOGLE_APPLICATION_CREDENTIALS.

Azure Configuration

Scope	Flag	Environment variable
Key Vault name (secret)	--vault-name	AZURE_KEYVAULT_NAME
App Configuration store (param)	--store-name	AZURE_APPCONFIG_NAME
Namespace (param)	--namespace / --ns	AZURE_APPCONFIG_NAMESPACE

The target is addressed by its globally-unique name, so no subscription or resource group is needed. Credentials come from the DefaultAzureCredential chain — set up locally with az login, or a service principal via AZURE_CLIENT_ID / AZURE_CLIENT_SECRET / AZURE_TENANT_ID. The namespace axis is Azure App Configuration's "label".

Using CLI

[!NOTE] The examples in this section use AWS Parameter Store and Secrets Manager through the bare suve param / suve stage aliases. Those aliases exist only when AWS is the only active backend for the service (see Bare Aliases). Otherwise, use the explicit group, such as suve aws param show. See Google Cloud and Azure for those backends.

Basic Commands

user@host:~$ suve param show /app/config/database-url
Name: /app/config/database-url
Version: 3
Type: SecureString
Modified: 2024-01-15T10:30:45Z

  postgres://db.example.com:5432/myapp

user@host:~$ suve param show --raw /app/config/database-url
postgres://db.example.com:5432/myapp

The show command displays value with metadata; --raw outputs raw value for piping:

# Use in scripts
DB_URL=$(suve param show --raw /app/config/database-url)

# Pipe to file
suve param show --raw /app/config/ssl-cert > cert.pem

Version History with log

View version history, just like git log:

user@host:~$ suve param log /app/config/database-url
Version 3 (current)
Date: 2024-01-15T10:30:45Z
postgres://db.example.com:5432/myapp...

Version 2
Date: 2024-01-14T09:20:30Z
postgres://old-db.example.com:5432/myapp...

Version 1
Date: 2024-01-13T08:10:00Z
postgres://localhost:5432/myapp...

Use --patch to see what changed in each version:

user@host:~$ suve param log --patch /app/config/database-url

Output will look like:

Version 3 (current)
Date: 2024-01-15T10:30:45Z

--- /app/config/database-url#2
+++ /app/config/database-url#3
@@ -1 +1 @@
-postgres://old-db.example.com:5432/myapp
+postgres://db.example.com:5432/myapp

Version 2
Date: 2024-01-14T09:20:30Z

--- /app/config/database-url#1
+++ /app/config/database-url#2
@@ -1 +1 @@
-postgres://localhost:5432/myapp
+postgres://old-db.example.com:5432/myapp

[!TIP] Add --parse-json to pretty-print JSON values before diffing. This normalizes formatting and sorts keys alphabetically, so you can focus on the actual content changes rather than formatting differences:

suve param log --patch --parse-json /app/config/credentials

Comparing Versions with diff

Compare previous version with latest (most common use case):

user@host:~$ suve param diff /app/config/database-url~

Output will look like:

--- /app/config/database-url#2
+++ /app/config/database-url#3
@@ -1 +1 @@
-postgres://old-db.example.com:5432/myapp
+postgres://db.example.com:5432/myapp

Compare any two specific versions:

user@host:~$ suve param diff /app/config/database-url#1 /app/config/database-url#3

Output will look like:

--- /app/config/database-url#1
+++ /app/config/database-url#3
@@ -1 +1 @@
-postgres://localhost:5432/myapp
+postgres://db.example.com:5432/myapp

Staging Workflow

[!NOTE] The staging workflow lets you prepare changes locally, review them, and apply when ready—just like git add → git diff --staged → git commit. For detailed documentation, see Stage Lifecycle.

[!TIP] Staged values live in encrypted files under ~/.suve/staging/. Use suve stage export to write them to portable snapshot files and suve stage import to restore them later. See Export / Import Commands for the forms each backend supports.

1. Stage changes (takes the value as an argument or from stdin with --value-stdin, or opens an editor in a terminal):

[!TIP] To use VSCode or Cursor as your editor, set export VISUAL='code --wait' or export VISUAL='cursor --wait' in your shell profile.

user@host:~$ suve stage param add /app/config/new-param "my-value"
✓ Staged for creation: /app/config/new-param

user@host:~$ suve stage param edit /app/config/database-url
✓ Staged: /app/config/database-url

user@host:~$ suve stage param delete /app/config/old-param
✓ Staged for deletion: /app/config/old-param

2. Review staged changes:

user@host:~$ suve stage status
Staged Parameter Store changes (3):
  A /app/config/new-param
  M /app/config/database-url
  D /app/config/old-param

user@host:~$ suve stage diff

Output will look like:

--- /app/config/database-url#3 (AWS)
+++ /app/config/database-url (staged)
@@ -1 +1 @@
-postgres://db.example.com:5432/myapp
+postgres://new-db.example.com:5432/myapp

--- /app/config/new-param (not in AWS)
+++ /app/config/new-param (staged for creation)
@@ -0,0 +1 @@
+my-value

--- /app/config/old-param#2 (AWS)
+++ /app/config/old-param (staged for deletion)
@@ -1 +0,0 @@
-deprecated-value

3. Apply changes:

user@host:~$ suve stage apply
Applying Parameter Store...
✓ Parameter Store: Created /app/config/new-param
✓ Parameter Store: Updated /app/config/database-url
✓ Parameter Store: Deleted /app/config/old-param

Reset if needed:

# Unstage specific parameter
suve stage param reset /app/config/database-url

# Unstage all
suve stage reset --all

[!TIP] suve stage apply prompts for confirmation before applying. Use --yes to skip the prompt.

Save changes for later (export / import):

# Export staged changes to a directory as one file per service
# (param.json / secret.json); prompts for a passphrase.
# By default the working staging area is cleared; use --keep to retain it.
suve stage export ./backup

# Restore them into the working staging area later
suve stage import ./backup

# Export a single service to a specific file
suve stage param export ./param-backup.json

# Import a single service from a specific file
suve stage param import ./param-backup.json

[!IMPORTANT] The directory form (suve stage export <dir> / suve stage import <dir>) is AWS-only. On Azure, export and import each service to its own file (suve stage secret export <file>, suve stage param export <file>). Google Cloud is secret-only, so suve stage export <file> exports its one service.

[!NOTE] export writes the working area out wholesale (no merge). import prompts to Merge or Overwrite only when the working area already holds changes; pass --merge / --overwrite to choose non-interactively.

[!NOTE] See Stage Lifecycle for detailed staging documentation.

Using GUI

--gui launches a desktop application (built with Wails) over the same use cases as the CLI and TUI. It ships only in the GUI-enabled build — the self-contained macOS/Windows binaries, or a Linux build with GTK3/WebKit2GTK (see Installation); the dependency-free CLI/TUI-only build has no --gui.

suve --gui                 # auto-detects the active provider (see Bare Aliases)

• Provider / scope: the GUI resolves the active provider from the environment just like the bare CLI aliases; when nothing is set or the choice is ambiguous it opens a provider picker instead of failing, and provider/scope stay re-selectable from within the running app.
• Tabs: one tab per service, labeled with the product name (Parameter Store / Secrets Manager on AWS, Secret Manager on Google Cloud, App Configuration / Key Vault on Azure), plus Staging. Each is gated by what the selected provider/scope supports — the same capability rules as the CLI (an unversioned backend hides version history, a secret-only provider has no param tab, and so on).
• Same operations: browse/filter, show with metadata, version history and diff, create/update/delete, and tag/untag are all available where the backend supports them; secret values are masked in passive views and revealed only on an explicit reveal or compare.
• Shared staging area: edits staged in the GUI use the same per-scope staging store as the CLI/TUI, so suve stage status sees them and stage apply from either side applies the same working set.

Using TUI

--tui launches a keyboard-driven terminal UI over the same use cases as the CLI and GUI. It is pure Go (no GTK/WebKit) and ships in every build. The provider and scope are fixed for the session at launch — switch provider by relaunching.

Launch forms:

suve --tui                 # only when exactly one provider is active (see Bare Aliases)
suve aws --tui             # explicit provider group (always available)
suve gcloud --tui
suve azure --tui
suve aws param --tui       # a service subgroup preselects that tab (Parameter Store)
suve azure secret --tui    # opens on the Key Vault tab

• Unique-provider rule: bare suve --tui follows the same detection as the bare aliases — it launches only when exactly one provider is active across the union of the param/secret/stage axes (AWS is also accepted via ~/.aws/credentials or ~/.aws/config, or an ambient-credential variable in a cloud shell — see Cloud Shell Support). With two or more active, it lists the explicit suve <group> --tui forms instead; there is no silent priority.
• Scope / env: the TUI consumes the same scope inputs as the CLI — GOOGLE_CLOUD_PROJECT for Google Cloud, --vault-name / AZURE_KEYVAULT_NAME and --store-name / AZURE_APPCONFIG_NAME (plus --namespace / AZURE_APPCONFIG_NAMESPACE, which the App Configuration tab's namespace filter starts on; an OR-list or prefix wildcard starts it on all namespaces) for Azure. AWS uses the ambient shared config. A flag wins over its env var, including an explicit empty --namespace "" (the default namespace).
• Azure tab gating: the App Configuration (param) and Key Vault (secret) tabs appear only for the services the launch scope resolves — set --vault-name for the Key Vault tab, --store-name for the App Configuration tab, either or both as needed. The Staging tab is always present.
• Shared staging area: staged edits made in the TUI use the same per-scope staging store as the CLI/GUI, so suve stage status sees them and stage apply from either side applies the same working set.
• The TUI adds no new commands and does not cover export/import (use the CLI/GUI for those). It requires an interactive terminal (a TTY on stdin and stdout).

Keymap (the in-app ? toggles full help, which is the source of truth):

Scope	Key	Action
Global	?	toggle help
Global	q / ctrl+c	quit
Global	tab / shift+tab	next / previous tab
Global	1 2 3	jump to tab
Global	↑/k, ↓/j	move selection
Global	enter	select / open detail
Global	esc	back / close
Global	y	copy value to the clipboard (the on-screen value stays masked)
Browser	p / /	edit prefix / filter
Browser	v	toggle value display
Browser	r	recursive toggle (Parameter Store) / refresh
Browser	[ / ]	narrow / widen the list pane
Browser	x	reveal a masked value
Browser	c, space, enter	compare mode: toggle, pick a version, open diff
Browser	space	pick namespace (App Configuration)
Browser	n / e / d / t / R	new / edit / delete / tag / restore
Compare / Diff	↑/↓	scroll the diff
Compare / Diff	s	toggle side-by-side / unified layout
Compare / Diff	x	hide / show a secret diff's values
Staging

JSON values are always pretty-printed automatically (parity with --parse-json), so there is no format toggle. Mutations are staged by default where the backend supports staging: completing a create, edit, or delete opens a Stage / Apply confirmation popup (←/→ choose, enter confirms, esc returns to the form); on a backend without staging the write is always immediate. Operation markers and unsupported controls follow each backend's capabilities. Rendering honors NO_COLOR and degrades gracefully on narrow terminals.

Version Specification

Navigate versions with Git-like syntax.

AWS SSM Parameter Store

[!NOTE] SSM Parameter Store uses numeric version numbers (1, 2, 3, ...) that auto-increment on each update.

<name>[#VERSION][~SHIFT]*
where ~SHIFT = ~ | ~N  (repeatable, cumulative)

Syntax	Description
/my/param	Latest version
/my/param#3	Version 3
/my/param~1	1 version ago
/my/param#5~2	Version 5 minus 2 = Version 3
/my/param~~	2 versions ago (~1~1)

AWS Secrets Manager

[!NOTE] Secrets Manager uses UUID version IDs and staging labels instead of numeric versions. AWSCURRENT and AWSPREVIOUS are special labels automatically managed by AWS—AWSCURRENT always points to the latest version.

<name>[#VERSION | :LABEL][~SHIFT]*
where ~SHIFT = ~ | ~N  (repeatable, cumulative)

Syntax	Description
my-secret	Current (AWSCURRENT)
my-secret:AWSPREVIOUS	Previous staging label
my-secret#abc123	Specific version ID
my-secret~1	1 version ago

[!IMPORTANT] When specifying version-only syntax like '#3' or ':AWSPREVIOUS', you must use quotes to prevent shell interpretation of the # (comment) or : characters.

[!TIP] ~ without a number means ~1. You can chain them: ~~ = ~1~1 = ~2

Google Cloud Secret Manager

[!NOTE] Google Cloud Secret Manager uses integer version numbers (1, 2, 3, ...) plus the latest alias. There are no staging labels, so :LABEL syntax does not apply.

Syntax	Description
my-secret	Latest version
my-secret#3	Version 3
my-secret~1	1 version ago

Azure Key Vault

[!NOTE] Azure Key Vault versions are opaque version IDs. There are no staging labels, so :LABEL syntax does not apply.

Syntax	Description
my-secret	Current version
my-secret#<id>	Specific version ID
my-secret~1	1 version ago

Azure App Configuration

[!NOTE] Azure App Configuration is unversioned. #, ~, and : are valid key characters — the whole argument is the literal key name, not a version spec — and log reports that history is unsupported.

Providers & Services

Providers

Each backend lives under a provider group; the group names take aliases:

Group	Aliases
aws	—
gcloud	gcp, google
azure	az

Group aliases are interchangeable with the group name (e.g. suve az kv show). Under azure stage, the secret / param subgroups take the same aliases as their read/write forms (kv / keyvault, appconfig / ac / appcfg).

Services

Each backend is a service under its provider group, with its own aliases:

Backend	Command	Aliases
AWS SSM Parameter Store	aws param	ssm, ps
AWS Secrets Manager	aws secret	sm, secretsmanager
Google Cloud Secret Manager	gcloud secret	secrets, sm
Azure Key Vault	azure secret	kv, keyvault
Azure App Configuration	azure param	appconfig, ac, appcfg

Staging is the same for every backend — <group> stage (alias stg), i.e. aws stage, gcloud stage, azure stage.

Bare form: when exactly one backend is active for a service (see Bare Aliases), drop the group prefix — every alias still works. So suve param / suve ssm, suve secret / suve kv, suve stage / suve stg, … resolve to the uniquely-active backend.

Bare Aliases

Every backend has an explicit command group that is always available, regardless of environment:

suve aws param    ...  # AWS Parameter Store
suve aws secret   ...  # AWS Secrets Manager
suve aws stage    ...  # AWS staging
suve gcloud secret ... # Google Cloud Secret Manager
suve gcloud stage  ... # Google Cloud staging
suve azure secret  ... # Azure Key Vault
suve azure param   ... # Azure App Configuration
suve azure stage   ... # Azure staging (secret = Key Vault, param = App Configuration)

For convenience, suve also exposes bare top-level aliases — suve param, suve secret, suve stage — but only when the environment makes the target unambiguous. param, secret, and stage are each resolved independently. All backends support staging, so stage follows the same "exactly one active backend" rule (Azure is staging-active when either AZURE_KEYVAULT_NAME or AZURE_APPCONFIG_NAME is set):

1. A backend is active when its identifying environment variable is set:

   Backend	Active when set
   AWS	AWS_ACCESS_KEY_ID, AWS_VAULT, AWS_PROFILE, AWS_DEFAULT_PROFILE, or an ambient-credential variable from AWS-managed compute (CloudShell / ECS / IRSA — see Cloud Shell Support)
   Google Cloud	GOOGLE_CLOUD_PROJECT
   Azure Key Vault (secret)	AZURE_KEYVAULT_NAME
   Azure App Configuration (param)	AZURE_APPCONFIG_NAME

2. The bare alias for a service appears only when exactly one backend is active for it. Zero or two-plus active → no alias, use the explicit group. There is no priority order — ambiguity is never resolved silently.

3. AWS fallback: if no backend is active via env at all, AWS is accepted when ~/.aws/credentials (or $AWS_SHARED_CREDENTIALS_FILE) or ~/.aws/config (or $AWS_CONFIG_FILE) exists. If both are absent, there are no bare aliases.

Examples (— = alias not exposed):

Environment	param →	secret →	stage →
nothing set, ~/.aws/credentials or ~/.aws/config present	aws	aws	aws
AWS_PROFILE	aws	aws	aws
AWS CloudShell (AWS_CONTAINER_CREDENTIALS_FULL_URI)	aws	aws	aws
GOOGLE_CLOUD_PROJECT	—	gcloud	gcloud
AZURE_KEYVAULT_NAME	—	azure	azure
AZURE_APPCONFIG_NAME	azure	—	azure
AWS_PROFILE + GOOGLE_CLOUD_PROJECT	aws	— (ambiguous)	— (ambiguous)
nothing set, no credentials file	—	—	—

suve --help lists which aliases are active in the current environment.

Command Reference

AWS SSM Parameter Store

Command	Options	Description
suve aws param show	--raw--parse-json (-j)--no-pager--output=<FORMAT>	Display parameter with metadata
suve aws param log	--number=<N> (-n)--patch (-p)--parse-json (-j)--oneline--reverse--since=<DATE>--until=<DATE>--no-pager--output=<FORMAT>	Show version history
suve aws param diff	--parse-json (-j)--no-pager--output=<FORMAT>	Compare versions
suve aws param list	--recursive (-R)--filter=<REGEX>--show--output=<FORMAT>	List parameters
suve aws param create	--type=<TYPE>--secure--description=<TEXT>--tier=<TIER>--data-type=<TYPE>--allowed-pattern=<REGEX>--policies=<JSON>	Create a new parameter
suve aws param update	--type=<TYPE>

AWS Secrets Manager

Command	Options	Description
suve aws secret show	--raw--parse-json (-j)--no-pager--output=<FORMAT>	Display secret with metadata
suve aws secret log	--number=<N> (-n)--patch (-p)--parse-json (-j)--oneline--reverse--since=<DATE>--until=<DATE>--no-pager--output=<FORMAT>	Show version history
suve aws secret diff	--parse-json (-j)--no-pager--output=<FORMAT>	Compare versions
suve aws secret list	--filter=<REGEX>--show--output=<FORMAT>	List secrets
suve aws secret create	--description=<TEXT>	Create new secret
suve aws secret update	--description=<TEXT>--yes	Update existing secret

Google Cloud Secret Manager

Uses integer version numbers (with the latest alias) and has no staging labels. Select the project with --project or the GOOGLE_CLOUD_PROJECT environment variable. Authentication uses Application Default Credentials (ADC). See docs/gcloud.md for details.

[!NOTE] Google Cloud Secret Manager calls key=value metadata "labels"; suve surfaces them under its cross-provider term tags (tag / untag). See Metadata Terminology.

Command	Options	Description
suve gcloud secret show	--raw--parse-json (-j)--no-pager--output=<FORMAT>	Display secret with metadata
suve gcloud secret log	--number=<N> (-n)--patch (-p)--parse-json (-j)--oneline--reverse--since=<DATE>--until=<DATE>--no-pager--output=<FORMAT>	Show version history
suve gcloud secret diff	--parse-json (-j)--no-pager--output=<FORMAT>	Compare versions
suve gcloud secret list	--filter=<REGEX>--show--output=<FORMAT>	List secrets
suve gcloud secret create		Create new secret
suve gcloud secret update	--yes	Update existing secret
suve gcloud secret delete

Azure Key Vault

Secrets are versioned by opaque IDs and have no staging labels. Select the vault with --vault-name or the AZURE_KEYVAULT_NAME environment variable — the vault name is a globally-unique endpoint, so no subscription or resource group is needed. Authentication uses the DefaultAzureCredential chain (environment, managed identity, Azure CLI, ...). See docs/azure.md for details.

Command	Options	Description
suve azure secret show	--raw--parse-json (-j)--no-pager--output=<FORMAT>	Display secret with metadata
suve azure secret log	--number=<N> (-n)--patch (-p)--parse-json (-j)--oneline--reverse--since=<DATE>--until=<DATE>--no-pager--output=<FORMAT>	Show version history
suve azure secret diff	--parse-json (-j)--no-pager--output=<FORMAT>	Compare versions
suve azure secret list	--filter=<REGEX>--show--output=<FORMAT>	List secrets
suve azure secret create		Create new secret
suve azure secret update	--yes	Update existing secret
suve azure secret delete

Azure App Configuration

Unversioned key-value store. #, ~, and : are valid key characters — the whole argument is the literal key name, not a version spec — and log reports that history is unsupported. tag / untag are supported via a GET-merge-PUT that preserves the value and any other tags (a value update likewise keeps existing tags). Select the store with --store-name or the AZURE_APPCONFIG_NAME environment variable — the store name is a globally-unique endpoint, so no subscription or resource group is needed. See docs/azure.md for details.

Command	Options	Description
suve azure param show	--namespace/--ns--raw--parse-json (-j)--no-pager--output=<FORMAT>	Display value with metadata
suve azure param list	--namespace/--ns--filter=<REGEX>--show--output=<FORMAT>	List keys
suve azure param create	--namespace/--ns	Create a new key
suve azure param update	--namespace/--ns--yes	Update an existing key
suve azure param delete	--namespace/--ns--yes	Delete a key
suve azure param tag	--namespace/--ns	Add or update tags (GET-merge-PUT)
suve azure param untag	--namespace/--ns	Remove tags

Namespaces

App Configuration addresses a setting by (key, label). This label axis is an identity dimension — a flat partition of the key space, like a Kubernetes namespace — not key=value metadata. Because "label" almost everywhere else means metadata (which suve unifies as tags), suve calls this axis a namespace; Azure App Configuration calls it a "label".

Select the namespace with --namespace (alias --ns) or the AZURE_APPCONFIG_NAMESPACE environment variable (precedence: flag > env > default). The default is the null namespace (App Configuration's unlabeled/default settings); a dev namespace never surfaces prod settings in list/show.

The value is interpreted by context:

Value	Meaning	Where
unset or ""	the null namespace (default; "" also overrides an env default back to null)	all commands
"*"	all namespaces (wildcard)	list/read only
"dev,prod"	dev OR prod (, = OR-list)	list/read only
"dev*"	prefix wildcard	list/read only
"dev"	the literal namespace dev	all commands
"\*", "foo\,bar"	a literal namespace containing a reserved char (\ escapes *, ,, \)	all commands

• List/read (list, show) forward the value to App Configuration's label filter, so * (all), dev* (prefix), and dev,prod (OR-list) work natively; an empty value maps to the null-namespace filter.
• Single-item ops (show, create, update, delete, staging) need exactly one namespace: \ escapes are decoded, and any unescaped * or , is a usage error (it names all/multiple namespaces). This is also how you address a namespace literally named * / , / \ — e.g. --namespace "\*".
• The namespace is a separate flag/env channel; the positional argument stays the whole key, so colon keys like Logging:LogLevel:Default are unaffected. The filter grammar (* , \) lives only inside the --namespace value.

Stage Commands

Every backend shares one staging workflow, invoked as suve <provider> stage <service> <command> — drop <provider> when it is the only active backend (Bare Aliases), and drop <service> on a secret-only provider (Google Cloud). Services are param / secret (AWS), secret (Azure Key Vault) / param (Azure App Configuration).

+---------+    +---------+    +---------+
|  edit   |--->|  stage  |--->|  apply  |
+---------+    +---------+    +---------+
     |              |              |
     |              |              v
     |              |       Applied to the backend
     |              |
     |              v
     |         status (view)
     |         diff (compare)
     |         reset (unstage)
     |              |
     |              v
     |         Discarded
     +-------------+

Command	Options	Description
add	--value-stdin⁴--description=<TEXT>¹	Stage a new entry
edit	--value-stdin⁴--description=<TEXT>¹	Stage a modification (a new version where the backend versions)
delete	AWS Secrets Manager: --force--recovery-window=<DAYS>	Stage a deletion
status	--verbose (-v)	Show staged changes
diff	--parse-json (-j)--no-pager	Compare staged vs the live backend
apply	--yes--ignore-conflicts²	Apply staged changes
reset	--all	Unstage; or reset <name>#<VERSION> / <name>~N restores that live version as the staged value³
tag / untag	<KEY>=<VALUE>... / <KEY>...	Stage tag additions / removals
export / import	see Export / Import Commands	Portable snapshot files (per service, or every AWS service at once)

¹ Only where the backend stores a description (AWS, Google Cloud); Azure omits the flag. AWS Parameter Store staging additionally accepts its type flags (--type, --secure).

² --ignore-conflicts is ignored by Azure App Configuration, which is unversioned (last-write-wins) and has no modified-after conflict to skip.

³ Restoring a version needs a versioned backend; on unversioned Azure App Configuration reset only unstages.

⁴ add / edit take the value as a positional argument (an explicit "" is an empty value), from stdin with --value-stdin, or from $EDITOR when both are omitted. Without a terminal, a missing value is an error instead of an editor launch.

Aggregate Stage Commands

suve stage <command> (and suve <backend> stage <command>) operate across every service of the active backend — AWS Parameter Store + Secrets Manager, or Azure Key Vault + App Configuration (Google Cloud is secret-only). The backend is resolved by the same bare-alias rules, and a backend that is not configured is skipped.

Command	Options	Description
suve stage status	--verbose (-v)	Show all staged changes
suve stage diff	--parse-json (-j)--no-pager	Compare all staged vs the live backend
suve stage apply	--yes--ignore-conflicts	Apply all staged changes
suve stage reset	--all	Unstage all changes

Export / Import Commands

Export writes the working staging area out to portable snapshot files (one per service) and import reads them back. Each file is a plaintext JSON envelope ({version, provider, scope, service, payload}) whose payload is passphrase-encrypted (Argon2id) or plaintext when the passphrase is empty. The full scope is embedded and validated on import.

Command	Backend	Argument	Options	Description
suve stage export	AWS	<dir>	--keep--yes (--force)--passphrase-stdin	Export every service with staged changes to <dir>/param.json + <dir>/secret.json
suve stage {param,secret} export	AWS, Azure	<file>	--keep--yes (--force)--passphrase-stdin	Export a single service to <file>
suve stage export	Google Cloud	<file>	--keep--yes (--force)--passphrase-stdin	Export the staged Secret Manager changes to <file>
suve stage import	AWS	<dir>	--merge--overwrite--yes--passphrase-stdin--allow-scope-mismatch	Import param.json / secret.json from <dir> (missing files skipped; nothing imported if both absent)
suve stage {param,secret} import	AWS, Azure	<file>	--merge--overwrite--yes--passphrase-stdin--allow-scope-mismatch	Import a single service from <file> (missing file or service mismatch is a hard error)
suve stage import	Google Cloud	<file>	--merge--overwrite--yes--passphrase-stdin--allow-scope-mismatch	Import Secret Manager changes from <file> (missing file or service mismatch is a hard error)

[!NOTE] Azure has no all-service export / import. Key Vault and App Configuration keep separate staging scopes, and one snapshot directory holds one scope. Export each Azure service to its own file instead.

• export writes the working area out wholesale; there is no --merge / --overwrite. By default it clears the working staging area; --keep retains it. --yes / --force skip the overwrite confirmation.
• Directory export is not atomic across files. On AWS, suve stage export <dir> writes param.json and secret.json as separate files. If the first write succeeds and the second fails (for example a full disk or a permissions error), the command aborts with an error and leaves a partial directory — a freshly written param.json alongside a stale or missing secret.json. Your working staging area is never touched, so no staged changes are lost; just re-run the export once the underlying problem is resolved and it overwrites the directory cleanly. Because each snapshot file embeds and validates its own scope on import, a later stage import <dir> restores whatever files are present per service without silently merging a mismatched pair; still, avoid importing a directory left behind by a failed export.
• import has no --keep (it is read-only on the file). --merge / --overwrite are mutually exclusive and only matter when the working area already holds changes; otherwise the file is applied directly. --allow-scope-mismatch imports even when the file's embedded scope differs from the current scope.

Environment Variables

Every variable below is optional; when a flag sets the same thing, the flag wins. Provider credentials and scope follow each cloud's native SDK conventions (see Authentication & Scopes), and the identifying variables also drive bare-alias provider selection.

Providers

Each backend is selected and authenticated from its own environment variables (all also settable via flags; see Bare Aliases).

AWS

Variable	Description
AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN	Static credentials
AWS_PROFILE / AWS_DEFAULT_PROFILE	Shared-config profile to load (AWS_PROFILE wins); either marks AWS active for the bare aliases
AWS_VAULT	Set by aws-vault; also marks AWS active for the bare aliases (see Bare Aliases)
AWS_CONTAINER_CREDENTIALS_FULL_URI / AWS_CONTAINER_CREDENTIALS_RELATIVE_URI / AWS_WEB_IDENTITY_TOKEN_FILE	Ambient credentials on AWS-managed compute (CloudShell, ECS/App Runner, EKS/IRSA); also mark AWS active — see Cloud Shell Support
AWS_REGION / AWS_DEFAULT_REGION	Region

Google Cloud

Variable	Description
GOOGLE_CLOUD_PROJECT	Project for Secret Manager (or use --project)

Azure

Variable	Description
AZURE_KEYVAULT_NAME	Key Vault name for azure secret (or use --vault-name)
AZURE_APPCONFIG_NAME	App Configuration store for azure param (or use --store-name)
AZURE_APPCONFIG_NAMESPACE	Default namespace for azure param — Azure calls this axis a "label" (or use --namespace/--ns)

Authentication uses the DefaultAzureCredential chain (az login, environment, managed identity, ...). The Key Vault / App Configuration name is a globally-unique endpoint, so no subscription or resource group is needed.

Staging

Variable	Description
SUVE_STAGING_KEY	Base64-encoded 32-byte key that overrides the OS keychain for encrypting the working staging state
SUVE_STAGING_ALLOW_PLAINTEXT	Set to a truthy value to permit writing the working staging state UNENCRYPTED in a non-interactive session when no key is available. Prefer SUVE_STAGING_KEY, which actually encrypts

Behavior & Diagnostics

Variable	Description
TZ	Timezone for date/time formatting — see Timezone below
SUVE_NO_UPDATE_CHECK	Opt out of the update-check notification
SUVE_DEBUG	Enable verbose debug logging (same as the global --debug flag); any non-empty value except 0/false enables it — see Debug Logging below
SUVE_NO_REDACTION	With debug enabled, log full request/response bodies and unmasked headers — including secret values and credentials (same as the global --no-redaction flag); parsed like SUVE_DEBUG — see Unredacted Output below
SUVE_TUI_FULL_REPAINT	Force the --tui renderer to fully repaint on scroll (any non-empty value), for browser-based terminals that mishandle scroll-region control sequences — see Cloud Shell Support below

Timezone

suve respects the TZ environment variable for date/time formatting:

# Show times in UTC
TZ=UTC suve param show /app/config

# Show times in Japan Standard Time
TZ=Asia/Tokyo suve param show /app/config

All timestamps are formatted in RFC3339 format with the local timezone offset applied. If TZ is not set, the system's local timezone is used. Invalid timezone values fall back to UTC.

Debug Logging

Pass the global --debug flag (or set SUVE_DEBUG=1) to trace what suve is doing on stderr. This is designed for the "command produces empty or unexpected output" case: it shows the decisions suve made before calling any API, the effective cloud configuration, each SDK request/response, and how many results each step produced:

suve secret ls --debug          # flag works in any position
SUVE_DEBUG=1 suve secret ls      # or via environment

Each entry starts with a [suve debug <time>] prefix (multi-line HTTP dumps are prefixed on their first line). The output includes:

• CLI decisions — the suve version and which provider each flat alias (param / secret / stage) resolved to.
• Effective configuration — for AWS, the resolved region, profile, and credentials source (the usual suspects when a listing is unexpectedly empty); for Google Cloud, the queried projects/... parent; for Azure, the credential the DefaultAzureCredential chain selected.
• SDK requests/responses — AWS HTTP request/response dumps (bodyless) with retries, gRPC calls with resource paths and durations for Google Cloud, and azcore request/response/retry/authentication events for Azure.
• Result counts — items returned per API page, and how many names survived the client-side prefix/regex filters, so "the API returned nothing" and "my filter dropped everything" are distinguishable.

Only request/response metadata is printed — secret values are never logged: AWS uses the bodyless log modes, and because the dump is taken after request signing, suve shows only an allowlist of non-sensitive headers (Host, X-Amz-Target, request IDs, …) and redacts every other header value — so the signing Authorization header, the session token, and any future credential-bearing header fail closed rather than leaking. The gRPC interceptor never prints request/reply messages; azcore redacts headers outside its own allowlist and never logs bodies (error events may include the service's error document, the same text normal error output already shows). Debug output goes to stderr, so it never contaminates piped stdout.

Unredacted Output

When the redacted default hides too much — e.g. you need to see the exact secret value a request returned, or the raw payload of a failing call — add --no-redaction (or set SUVE_NO_REDACTION=1) alongside --debug:

suve secret show my-secret --debug --no-redaction

This switches AWS to the with-body log modes and stops masking headers, and turns on azcore body logging for Azure, so full request/response bodies and credentials — including secret values and the signing Authorization header — are written to stderr. Use it only for deliberate, local debugging and never where the log could be captured or shared; a one-line warning is printed to stderr whenever it is active. It has no effect without --debug (you'll get a hint saying so), and no effect on Google Cloud, whose gRPC interceptor logs no message bodies at all.

Cloud Shell Support

suve runs in the browser-based cloud shells, with two environment-specific behaviors worth knowing.

Provider auto-selection. In AWS CloudShell, credentials are delivered through a container-credentials endpoint rather than AWS_ACCESS_KEY_ID / AWS_PROFILE or a ~/.aws/credentials file, so AWS is detected from the ambient-credential variables that AWS-managed compute sets:

Variable	Set by
AWS_CONTAINER_CREDENTIALS_FULL_URI	CloudShell, App Runner, EKS Pod Identity
AWS_CONTAINER_CREDENTIALS_RELATIVE_URI	ECS
AWS_WEB_IDENTITY_TOKEN_FILE	IRSA / EKS

Any of these marks AWS active for the bare param / secret / stage aliases (and bare suve --tui), exactly like AWS_PROFILE. Detection reads environment variables only — no network calls — so shell completion stays instant. Google Cloud Shell and Azure Cloud Shell auto-select through their existing variables (GOOGLE_CLOUD_PROJECT; AZURE_KEYVAULT_NAME / AZURE_APPCONFIG_NAME).

A bare EC2 instance profile delivers credentials only over IMDS, which sets no environment marker, so it is not auto-detected — use the explicit suve aws ... group there.

TUI rendering. The --tui renderer relies on a terminal scroll-region optimization that some browser terminals (notably CloudShell's xterm.js) mishandle, corrupting the display while scrolling. suve detects the known cloud shells — AWS_EXECUTION_ENV=CloudShell, CLOUD_SHELL=true (Google), AZUREPS_HOST_ENVIRONMENT=cloud-shell/… (Azure) — and forces a clean full repaint on scroll there (lists, history, value/diff panes, staging, dialogs, and the create/edit/tag forms), leaving native terminals on the fast path untouched. If you hit scroll corruption in another browser-based terminal, set SUVE_TUI_FULL_REPAINT=1 to opt into the same full-repaint behavior; resizing the terminal once also clears a corrupted frame.

Development

# Run tests
mise test

# Run linter
mise lint

# Build CLI (without GUI)
mise build-cli

# Build with GUI support — builds the frontend first, then embeds it into
# bin/suve. (A bare `go build -tags production` skips the frontend build, so the
# binary aborts at `suve --gui` with "no index.html could be found".)
mise build-gui

# Run E2E tests (requires Docker)
mise e2e-aws

# Coverage (unit + E2E combined)
mise coverage-all

Local Development with Emulators

mise run bash starts the selected cloud's emulator(s) and opens a shell with the right environment injected, so suve (and suve --gui) talk to the local emulators and auto-detect the active provider. Flags combine freely (0–4):

mise run bash --aws               # AWS (localstack: SSM + Secrets Manager)
mise run bash --gcloud            # Google Cloud Secret Manager
mise run bash --azure-appconfig   # Azure App Configuration
mise run bash --azure-keyvault    # Azure Key Vault
mise run bash --azure             # both Azure services
mise run bash --aws --gcloud --azure   # everything at once

# inside the shell (with one provider active):
suve --gui        # auto-detects the active provider
suve param ls
suve secret list

# with several providers active, name the group:
suve aws param ls
suve gcloud secret list

Containers keep running after you exit the shell; stop them with docker compose down (or mise run clean).

Every cloud is behind a docker compose profile (aws / gcloud / azure), so nothing starts by default. To drive the AWS emulator manually instead of the shell above:

SUVE_LOCALSTACK_EXTERNAL_PORT=4566 docker compose --profile aws up -d
AWS_ENDPOINT_URL=http://127.0.0.1:4566 \
AWS_ACCESS_KEY_ID=dummy \
AWS_SECRET_ACCESS_KEY=dummy \
AWS_DEFAULT_REGION=us-east-1 \
suve param ls
docker compose down

[!IMPORTANT] Dummy credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) are required to prevent the SDK from attempting IAM role credential fetching. The mise run bash --aws shell sets these for you.

License

MIT License