token_hex
token_hex(32)or:Copyopenssl rand -hex 32Important: If you configure encryption for your SQL database secrets store, you should keep the ZENML_SECRETS_STORE_ENCRYPTION_KEY value somewhere safe and secure, as it will always be required by the ZenML server to decrypt the secrets in the database. If you lose the encryption key, you will not be able to decrypt the secrets in the database and will have to reset them.

These configuration options are only relevant if you're using the AWS Secrets Manager as the secrets store backend.

ZENML_SECRETS_STORE_TYPE: Set this to aws in order to set this type of secret store.

The AWS Secrets Store uses the ZenML AWS Service Connector under the hood to authenticate with the AWS Secrets Manager API. This means that you can use any of the authentication methods supported by the AWS Service Connector to authenticate with the AWS Secrets Manager API.

"Version": "2012-10-17",

"Statement": [

"Sid": "ZenMLSecretsStore",

"Effect": "Allow",

"Action": [

"secretsmanager:CreateSecret",

"secretsmanager:GetSecretValue",

"secretsmanager:DescribeSecret",

"secretsmanager:PutSecretValue",

"secretsmanager:TagResource",

"secretsmanager:DeleteSecret"

],

"Resource": "arn:aws:secretsmanager:<AWS-region>:<AWS-account-id>:secret:zenml/*"

The following configuration options are supported:

ZENML_SECRETS_STORE_AUTH_METHOD: The AWS Service Connector authentication method to use (e.g. secret-key or iam-role).

ZENML_SECRETS_STORE_AUTH_CONFIG: The AWS Service Connector configuration, in JSON format (e.g. {"aws_access_key_id":"<aws-key-id>","aws_secret_access_key":"<aws-secret-key>","region":"<aws-region>"}).

Note: The remaining configuration options are deprecated and may be removed in a future release. Instead, you should set the ZENML_SECRETS_STORE_AUTH_METHOD and ZENML_SECRETS_STORE_AUTH_CONFIG variables to use the AWS Service Connector authentication method.