My elastic beanstalk app has a number of environment variables that are confidential (e.g. API keys, hashing secrets etc.). I would like to setup AWS so that most developers can view and edit config etc, but can't see some of these environment variables. It would be a large overhead if we had to change all of these each time a developer leaves, for example.
From playing about with permissions, it seems (with Elastic Beanstalk at least) you can either have complete access to the config or can't see any of it - and removing access entirely would mean a developer can't even do basic things like see why a deployment failed.
I'm wondering if there's another approach to environment variables that might allow me to give devs access to this config, but obscure the highly confidential stuff. Could I put secret env vars in a file on the server?
Is there another way of doing this?