Secrets and Outputs
Stack outputs
Section titled “Stack outputs”| Output | Purpose |
|---|---|
ApiUrl | Base API URL (before analyze) for CLI / GHA |
ApiKeyId | ID used to retrieve the key value once |
CognitoUserPoolId / CognitoClientId / CognitoRegion | SPA auth |
AmplifyAppId / AmplifyBranchName | Zip deploy targets |
AppUrl | Hosted owner UI URL |
The API key value is never a stack output — retrieve with get-api-key --include-value.
GitHub Actions secrets / variables
Section titled “GitHub Actions secrets / variables”| Name | Used by | Notes |
|---|---|---|
AWS_ROLE_ARN | Deploy (OIDC) | Secret |
AWS_REGION | Deploy | Optional variable; default ap-southeast-2 |
PR_READY_OWNER_EMAIL | Deploy / Cognito invite | Secret preferred — Deploy reads secret first, then Actions variable |
PR_READY_API_URL | pr-ready.yml | Secret — set after first deploy |
PR_READY_API_KEY | pr-ready.yml | Secret — key value, not ApiKeyId |
ENABLE_CDK_DIFF | Optional CI | Variable true enables cdk-diff |
Browser env (VITE_*)
Section titled “Browser env (VITE_*)”Bake at build time into the SPA: API URL + Cognito IDs only. No VITE_API_KEY.