Command Reference¶

AWS SSM Parameter Store¶

Command	Options	Description
`suve aws param show`	`--raw` `--parse-json` (`-j`) `--no-pager` `--output=<FORMAT>`	Display parameter with metadata
`suve aws param log`	`--number=<N>` (`-n`) `--patch` (`-p`) `--parse-json` (`-j`) `--oneline` `--reverse` `--since=<DATE>` `--until=<DATE>` `--no-pager` `--output=<FORMAT>`	Show version history
`suve aws param diff`	`--parse-json` (`-j`) `--no-pager` `--output=<FORMAT>`	Compare versions
`suve aws param list`	`--recursive` (`-R`) `--filter=<REGEX>` `--show` `--output=<FORMAT>`	List parameters
`suve aws param create`	`--type=<TYPE>` `--secure` `--description=<TEXT>` `--tier=<TIER>` `--data-type=<TYPE>` `--allowed-pattern=<REGEX>` `--policies=<JSON>`	Create a new parameter
`suve aws param update`	`--type=<TYPE>` `--secure` `--description=<TEXT>` `--tier=<TIER>` `--data-type=<TYPE>` `--allowed-pattern=<REGEX>` `--policies=<JSON>` `--yes`	Update an existing parameter
`suve aws param delete`	`--yes`	Delete parameter
`suve aws param tag`	`<KEY>=<VALUE>...`	Add or update tags
`suve aws param untag`	`<KEY>...`	Remove tags

AWS Secrets Manager¶

Command	Options	Description
`suve aws secret show`	`--raw` `--parse-json` (`-j`) `--no-pager` `--output=<FORMAT>`	Display secret with metadata
`suve aws secret log`	`--number=<N>` (`-n`) `--patch` (`-p`) `--parse-json` (`-j`) `--oneline` `--reverse` `--since=<DATE>` `--until=<DATE>` `--no-pager` `--output=<FORMAT>`	Show version history
`suve aws secret diff`	`--parse-json` (`-j`) `--no-pager` `--output=<FORMAT>`	Compare versions
`suve aws secret list`	`--filter=<REGEX>` `--show` `--output=<FORMAT>`	List secrets
`suve aws secret create`	`--description=<TEXT>`	Create new secret
`suve aws secret update`	`--description=<TEXT>` `--yes`	Update existing secret
`suve aws secret delete`	`--force` `--recovery-window=<DAYS>` `--yes`	Delete secret
`suve aws secret restore`		Restore deleted secret
`suve aws secret tag`	`<KEY>=<VALUE>...`	Add or update tags
`suve aws secret untag`	`<KEY>...`	Remove tags

Google Cloud Secret Manager¶

Uses integer version numbers (with the latest alias) and has no staging labels. Select the project with --project or the GOOGLE_CLOUD_PROJECT environment variable. Authentication uses Application Default Credentials (ADC). See docs/gcloud.md for details.

Note

Google Cloud Secret Manager calls key=value metadata "labels"; suve surfaces them under its cross-provider term tags (tag / untag). See Metadata Terminology.

Command	Options	Description
`suve gcloud secret show`	`--raw` `--parse-json` (`-j`) `--no-pager` `--output=<FORMAT>`	Display secret with metadata
`suve gcloud secret log`	`--number=<N>` (`-n`) `--patch` (`-p`) `--parse-json` (`-j`) `--oneline` `--reverse` `--since=<DATE>` `--until=<DATE>` `--no-pager` `--output=<FORMAT>`	Show version history
`suve gcloud secret diff`	`--parse-json` (`-j`) `--no-pager` `--output=<FORMAT>`	Compare versions
`suve gcloud secret list`	`--filter=<REGEX>` `--show` `--output=<FORMAT>`	List secrets
`suve gcloud secret create`		Create new secret
`suve gcloud secret update`	`--yes`	Update existing secret
`suve gcloud secret delete`	`--yes`	Delete secret
`suve gcloud secret tag`	`<KEY>=<VALUE>...`	Add or update tags (Google Cloud "labels")
`suve gcloud secret untag`	`<KEY>...`	Remove tags (Google Cloud "labels")

Azure Key Vault¶

Secrets are versioned by opaque IDs and have no staging labels. Select the vault with --vault-name or the AZURE_KEYVAULT_NAME environment variable — the vault name is a globally-unique endpoint, so no subscription or resource group is needed. Authentication uses the DefaultAzureCredential chain (environment, managed identity, Azure CLI, ...). See docs/azure.md for details.

Command	Options	Description
`suve azure secret show`	`--raw` `--parse-json` (`-j`) `--no-pager` `--output=<FORMAT>`	Display secret with metadata
`suve azure secret log`	`--number=<N>` (`-n`) `--patch` (`-p`) `--parse-json` (`-j`) `--oneline` `--reverse` `--since=<DATE>` `--until=<DATE>` `--no-pager` `--output=<FORMAT>`	Show version history
`suve azure secret diff`	`--parse-json` (`-j`) `--no-pager` `--output=<FORMAT>`	Compare versions
`suve azure secret list`	`--filter=<REGEX>` `--show` `--output=<FORMAT>`	List secrets
`suve azure secret create`		Create new secret
`suve azure secret update`	`--yes`	Update existing secret
`suve azure secret delete`	`--yes`	Delete secret (soft-delete)
`suve azure secret restore`		Recover a soft-deleted secret
`suve azure secret tag`	`<KEY>=<VALUE>...`	Add or update tags
`suve azure secret untag`	`<KEY>...`	Remove tags

Azure App Configuration¶

Unversioned key-value store. #, ~, and : are valid key characters — the whole argument is the literal key name, not a version spec — and log reports that history is unsupported. tag / untag are supported via a GET-merge-PUT that preserves the value and any other tags (a value update likewise keeps existing tags). Select the store with --store-name or the AZURE_APPCONFIG_NAME environment variable — the store name is a globally-unique endpoint, so no subscription or resource group is needed. See docs/azure.md for details.

Command	Options	Description
`suve azure param show`	`--namespace`/`--ns` `--raw` `--parse-json` (`-j`) `--no-pager` `--output=<FORMAT>`	Display value with metadata
`suve azure param list`	`--namespace`/`--ns` `--filter=<REGEX>` `--show` `--output=<FORMAT>`	List keys
`suve azure param create`	`--namespace`/`--ns`	Create a new key
`suve azure param update`	`--namespace`/`--ns` `--yes`	Update an existing key
`suve azure param delete`	`--namespace`/`--ns` `--yes`	Delete a key
`suve azure param tag`	`--namespace`/`--ns`	Add or update tags (GET-merge-PUT)
`suve azure param untag`	`--namespace`/`--ns`	Remove tags

Namespaces¶

App Configuration addresses a setting by (key, label). This label axis is an identity dimension — a flat partition of the key space, like a Kubernetes namespace — not key=value metadata. Because "label" almost everywhere else means metadata (which suve unifies as tags), suve calls this axis a namespace; Azure App Configuration calls it a "label".

Select the namespace with --namespace (alias --ns) or the AZURE_APPCONFIG_NAMESPACE environment variable (precedence: flag > env > default). The default is the null namespace (App Configuration's unlabeled/default settings); a dev namespace never surfaces prod settings in list/show.

The value is interpreted by context:

Value	Meaning	Where
unset or `""`	the null namespace (default; `""` also overrides an env default back to null)	all commands
`"*"`	all namespaces (wildcard)	list/read only
`"dev,prod"`	dev OR prod (`,` = OR-list)	list/read only
`"dev*"`	prefix wildcard	list/read only
`"dev"`	the literal namespace `dev`	all commands
`"\*"`, `"foo\,bar"`	a literal namespace containing a reserved char (`\` escapes `*`, `,`, `\`)	all commands

List/read (list, show) forward the value to App Configuration's label filter, so * (all), dev* (prefix), and dev,prod (OR-list) work natively; an empty value maps to the null-namespace filter.
Single-item ops (show, create, update, delete, staging) need exactly one namespace: \ escapes are decoded, and any unescaped * or , is a usage error (it names all/multiple namespaces). This is also how you address a namespace literally named * / , / \ — e.g. --namespace "\*".
The namespace is a separate flag/env channel; the positional argument stays the whole key, so colon keys like Logging:LogLevel:Default are unaffected. The filter grammar (* , \) lives only inside the --namespace value.

Stage Commands¶

Every backend shares one staging workflow, invoked as suve <provider> stage <service> <command> — drop <provider> when it is the only active backend (Bare Aliases), and drop <service> on a secret-only provider (Google Cloud). Services are param / secret (AWS), secret (Azure Key Vault) / param (Azure App Configuration).

+---------+    +---------+    +---------+
|  edit   |--->|  stage  |--->|  apply  |
+---------+    +---------+    +---------+
     |              |              |
     |              |              v
     |              |       Applied to the backend
     |              |
     |              v
     |         status (view)
     |         diff (compare)
     |         reset (unstage)
     |              |
     |              v
     |         Discarded
     +-------------+

Command	Options	Description
`add`	`--value-stdin`⁴ `--description=<TEXT>`¹	Stage a new entry
`edit`	`--value-stdin`⁴ `--description=<TEXT>`¹	Stage a modification (a new version where the backend versions)
`delete`	AWS Secrets Manager: `--force` `--recovery-window=<DAYS>`	Stage a deletion
`status`	`--verbose` (`-v`)	Show staged changes
`diff`	`--parse-json` (`-j`) `--no-pager`	Compare staged vs the live backend
`apply`	`--yes` `--ignore-conflicts`²	Apply staged changes
`reset`	`--all`	Unstage; or `reset <name>#<VERSION>` / `<name>~N` restores that live version as the staged value³
`tag` / `untag`	`<KEY>=<VALUE>...` / `<KEY>...`	Stage tag additions / removals
`export` / `import`	see Export / Import Commands	Portable snapshot files (per service, or every AWS service at once)

¹ Only where the backend stores a description (AWS, Google Cloud); Azure omits the flag. AWS Parameter Store staging additionally accepts its type flags (--type, --secure).

² --ignore-conflicts is ignored by Azure App Configuration, which is unversioned (last-write-wins) and has no modified-after conflict to skip.

³ Restoring a version needs a versioned backend; on unversioned Azure App Configuration reset only unstages.

⁴ add / edit take the value as a positional argument (an explicit "" is an empty value), from stdin with --value-stdin, or from $EDITOR when both are omitted. Without a terminal, a missing value is an error instead of an editor launch.

Aggregate Stage Commands¶

suve stage <command> (and suve <backend> stage <command>) operate across every service of the active backend — AWS Parameter Store + Secrets Manager, or Azure Key Vault + App Configuration (Google Cloud is secret-only). The backend is resolved by the same bare-alias rules, and a backend that is not configured is skipped.

Command	Options	Description
`suve stage status`	`--verbose` (`-v`)	Show all staged changes
`suve stage diff`	`--parse-json` (`-j`) `--no-pager`	Compare all staged vs the live backend
`suve stage apply`	`--yes` `--ignore-conflicts`	Apply all staged changes
`suve stage reset`	`--all`	Unstage all changes

Export / Import Commands¶

Export writes the working staging area out to portable snapshot files (one per service) and import reads them back. Each file is a plaintext JSON envelope ({version, provider, scope, service, payload}) whose payload is passphrase-encrypted (Argon2id) or plaintext when the passphrase is empty. The full scope is embedded and validated on import.

Command	Backend	Argument	Options	Description
`suve stage export`	AWS	`<dir>`	`--keep` `--yes` (`--force`) `--passphrase-stdin`	Export every service with staged changes to `<dir>/param.json` + `<dir>/secret.json`
`suve stage {param,secret} export`	AWS, Azure	`<file>`	`--keep` `--yes` (`--force`) `--passphrase-stdin`	Export a single service to `<file>`
`suve stage export`	Google Cloud	`<file>`	`--keep` `--yes` (`--force`) `--passphrase-stdin`	Export the staged Secret Manager changes to `<file>`
`suve stage import`	AWS	`<dir>`	`--merge` `--overwrite` `--yes` `--passphrase-stdin` `--allow-scope-mismatch`	Import `param.json` / `secret.json` from `<dir>` (missing files skipped; nothing imported if both absent)
`suve stage {param,secret} import`	AWS, Azure	`<file>`	`--merge` `--overwrite` `--yes` `--passphrase-stdin` `--allow-scope-mismatch`	Import a single service from `<file>` (missing file or service mismatch is a hard error)
`suve stage import`	Google Cloud	`<file>`	`--merge` `--overwrite` `--yes` `--passphrase-stdin` `--allow-scope-mismatch`	Import Secret Manager changes from `<file>` (missing file or service mismatch is a hard error)

Note

Azure has no all-service export / import. Key Vault and App Configuration keep separate staging scopes, and one snapshot directory holds one scope. Export each Azure service to its own file instead.

export writes the working area out wholesale; there is no --merge / --overwrite. By default it clears the working staging area; --keep retains it. --yes / --force skip the overwrite confirmation.
Directory export is not atomic across files. On AWS, suve stage export <dir> writes param.json and secret.json as separate files. If the first write succeeds and the second fails (for example a full disk or a permissions error), the command aborts with an error and leaves a partial directory — a freshly written param.json alongside a stale or missing secret.json. Your working staging area is never touched, so no staged changes are lost; just re-run the export once the underlying problem is resolved and it overwrites the directory cleanly. Because each snapshot file embeds and validates its own scope on import, a later stage import <dir> restores whatever files are present per service without silently merging a mismatched pair; still, avoid importing a directory left behind by a failed export.
import has no --keep (it is read-only on the file). --merge / --overwrite are mutually exclusive and only matter when the working area already holds changes; otherwise the file is applied directly. --allow-scope-mismatch imports even when the file's embedded scope differs from the current scope.