Environment Variables¶

Every variable below is optional; when a flag sets the same thing, the flag wins. Provider credentials and scope follow each cloud's native SDK conventions (see Authentication & Scopes), and the identifying variables also drive bare-alias provider selection.

Providers¶

Each backend is selected and authenticated from its own environment variables (all also settable via flags; see Bare Aliases).

AWS¶

Variable	Description
`AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`	Static credentials
`AWS_PROFILE` / `AWS_DEFAULT_PROFILE`	Shared-config profile to load (`AWS_PROFILE` wins); either marks AWS active for the bare aliases
`AWS_VAULT`	Set by aws-vault; also marks AWS active for the bare aliases (see Bare Aliases)
`AWS_CONTAINER_CREDENTIALS_FULL_URI` / `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI` / `AWS_WEB_IDENTITY_TOKEN_FILE`	Ambient credentials on AWS-managed compute (CloudShell, ECS/App Runner, EKS/IRSA); also mark AWS active — see Cloud Shell Support
`AWS_REGION` / `AWS_DEFAULT_REGION`	Region

Google Cloud¶

Variable	Description
`GOOGLE_CLOUD_PROJECT`	Project for Secret Manager (or use `--project`)

Azure¶

Variable	Description
`AZURE_KEYVAULT_NAME`	Key Vault name for `azure secret` (or use `--vault-name`)
`AZURE_APPCONFIG_NAME`	App Configuration store for `azure param` (or use `--store-name`)
`AZURE_APPCONFIG_NAMESPACE`	Default namespace for `azure param` — Azure calls this axis a "label" (or use `--namespace`/`--ns`)

Authentication uses the DefaultAzureCredential chain (az login, environment, managed identity, ...). The Key Vault / App Configuration name is a globally-unique endpoint, so no subscription or resource group is needed.

Staging¶

Variable	Description
`SUVE_STAGING_KEY`	Base64-encoded 32-byte key that overrides the OS keychain for encrypting the working staging state
`SUVE_STAGING_ALLOW_PLAINTEXT`	Set to a truthy value to permit writing the working staging state UNENCRYPTED in a non-interactive session when no key is available. Prefer `SUVE_STAGING_KEY`, which actually encrypts

Behavior & Diagnostics¶

Variable	Description
`TZ`	Timezone for date/time formatting — see Timezone below
`SUVE_NO_UPDATE_CHECK`	Opt out of the update-check notification
`SUVE_DEBUG`	Enable verbose debug logging (same as the global `--debug` flag); any non-empty value except `0`/`false` enables it — see Debug Logging below
`SUVE_NO_REDACTION`	With debug enabled, log full request/response bodies and unmasked headers — including secret values and credentials (same as the global `--no-redaction` flag); parsed like `SUVE_DEBUG` — see Unredacted Output below
`SUVE_TUI_FULL_REPAINT`	Force the `--tui` renderer to fully repaint on scroll (any non-empty value), for browser-based terminals that mishandle scroll-region control sequences — see Cloud Shell Support below

Timezone¶

suve respects the TZ environment variable for date/time formatting:

# Show times in UTC
TZ=UTC suve param show /app/config

# Show times in Japan Standard Time
TZ=Asia/Tokyo suve param show /app/config

All timestamps are formatted in RFC3339 format with the local timezone offset applied. If TZ is not set, the system's local timezone is used. Invalid timezone values fall back to UTC.

Debug Logging¶

Pass the global --debug flag (or set SUVE_DEBUG=1) to trace what suve is doing on stderr. This is designed for the "command produces empty or unexpected output" case: it shows the decisions suve made before calling any API, the effective cloud configuration, each SDK request/response, and how many results each step produced:

suve secret ls --debug          # flag works in any position
SUVE_DEBUG=1 suve secret ls      # or via environment

Each entry starts with a [suve debug <time>] prefix (multi-line HTTP dumps are prefixed on their first line). The output includes:

CLI decisions — the suve version and which provider each flat alias (param / secret / stage) resolved to.
Effective configuration — for AWS, the resolved region, profile, and credentials source (the usual suspects when a listing is unexpectedly empty); for Google Cloud, the queried projects/... parent; for Azure, the credential the DefaultAzureCredential chain selected.
SDK requests/responses — AWS HTTP request/response dumps (bodyless) with retries, gRPC calls with resource paths and durations for Google Cloud, and azcore request/response/retry/authentication events for Azure.
Result counts — items returned per API page, and how many names survived the client-side prefix/regex filters, so "the API returned nothing" and "my filter dropped everything" are distinguishable.

Only request/response metadata is printed — secret values are never logged: AWS uses the bodyless log modes, and because the dump is taken after request signing, suve shows only an allowlist of non-sensitive headers (Host, X-Amz-Target, request IDs, …) and redacts every other header value — so the signing Authorization header, the session token, and any future credential-bearing header fail closed rather than leaking. The gRPC interceptor never prints request/reply messages; azcore redacts headers outside its own allowlist and never logs bodies (error events may include the service's error document, the same text normal error output already shows). Debug output goes to stderr, so it never contaminates piped stdout.

Unredacted Output¶

When the redacted default hides too much — e.g. you need to see the exact secret value a request returned, or the raw payload of a failing call — add --no-redaction (or set SUVE_NO_REDACTION=1) alongside --debug:

suve secret show my-secret --debug --no-redaction

This switches AWS to the with-body log modes and stops masking headers, and turns on azcore body logging for Azure, so full request/response bodies and credentials — including secret values and the signing Authorization header — are written to stderr. Use it only for deliberate, local debugging and never where the log could be captured or shared; a one-line warning is printed to stderr whenever it is active. It has no effect without --debug (you'll get a hint saying so), and no effect on Google Cloud, whose gRPC interceptor logs no message bodies at all.

Cloud Shell Support¶

suve runs in the browser-based cloud shells, with two environment-specific behaviors worth knowing.

Provider auto-selection. In AWS CloudShell, credentials are delivered through a container-credentials endpoint rather than AWS_ACCESS_KEY_ID / AWS_PROFILE or a ~/.aws/credentials file, so AWS is detected from the ambient-credential variables that AWS-managed compute sets:

Variable	Set by
`AWS_CONTAINER_CREDENTIALS_FULL_URI`	CloudShell, App Runner, EKS Pod Identity
`AWS_CONTAINER_CREDENTIALS_RELATIVE_URI`	ECS
`AWS_WEB_IDENTITY_TOKEN_FILE`	IRSA / EKS

Any of these marks AWS active for the bare param / secret / stage aliases (and bare suve --tui), exactly like AWS_PROFILE. Detection reads environment variables only — no network calls — so shell completion stays instant. Google Cloud Shell and Azure Cloud Shell auto-select through their existing variables (GOOGLE_CLOUD_PROJECT; AZURE_KEYVAULT_NAME / AZURE_APPCONFIG_NAME).

A bare EC2 instance profile delivers credentials only over IMDS, which sets no environment marker, so it is not auto-detected — use the explicit suve aws ... group there.

TUI rendering. The --tui renderer relies on a terminal scroll-region optimization that some browser terminals (notably CloudShell's xterm.js) mishandle, corrupting the display while scrolling. suve detects the known cloud shells — AWS_EXECUTION_ENV=CloudShell, CLOUD_SHELL=true (Google), AZUREPS_HOST_ENVIRONMENT=cloud-shell/… (Azure) — and forces a clean full repaint on scroll there (lists, history, value/diff panes, staging, dialogs, and the create/edit/tag forms), leaving native terminals on the fast path untouched. If you hit scroll corruption in another browser-based terminal, set SUVE_TUI_FULL_REPAINT=1 to opt into the same full-repaint behavior; resizing the terminal once also clears a corrupted frame.