Ingredients

An ingredient is ramenv’s key-storage provider. It stores workspace encryption keys and vault-signing keys. Application values remain in .ramenv.vault.toml.

Choose a provider

Ingredient	Key storage	Setup guide
local	Raw keys in .ramenv.keys at the workspace root	Local keys
aws	AWS Secrets Manager	AWS
azure	Azure Key Vault	Azure
google	Google Cloud Secret Manager	Google Cloud

ramenv menu

Select one ingredient when creating a new workspace:

ramenv init --ingredient local
# Or choose one cloud provider:
ramenv init --ingredient aws
ramenv init --ingredient azure
ramenv init --ingredient google

Run one of these commands for a new workspace. Omitting the option selects local.

For a monorepo root without a root vault:

ramenv init workspace --ingredient aws

The selected ingredient is saved in .ramenv.workspace.toml and reused by runtime commands. Re-running init with another ingredient does not migrate keys or convert an existing workspace.

Understand the files

File	Contents	Version control
.ramenv.workspace.toml	Workspace name, schema version, ingredient	Commit.
.ramenv.vault.toml	Environment data, validation rules, integrity metadata	Commit after reviewing plaintext.
.ramenv.keys	Raw local encryption and signing keys	Never commit.
.ramenv.keyrefs.toml	Cloud location and version-pinned resource references	Can be committed; no raw keys or credentials.
.env	Optional onboarding input	Keep private; onboarding does not remove it.

Cloud refs identify exact key versions: an AWS ARN with a version ID, an Azure versioned secret URI, or a Google numeric secret-version resource. Reads do not silently select the latest version.

Authenticate before initialization

Local developer examples:

# AWS: configured SSO profile
aws sso login --profile dev
export AWS_PROFILE=dev

# Azure: existing Key Vault required
az login
export RAMENV_AZURE_CREDENTIAL=developer-tools

# Google Cloud: ADC, not only the gcloud CLI login
gcloud auth application-default login

Initialization asks for the AWS region, an existing Azure Key Vault URL, or the Google storage project ID. Google also requires the Secret Manager API to be enabled.

The signed-in identity also needs secret-store permissions. Check the provider guide for permission names and credential selection before initializing or deploying.

Know what remains visible

Environment names, variable names, validation rules, and values stored as plaintext remain readable in Git.

Cloud permissions control who can obtain the keys. Once decrypted, values can still be exposed by an authorized process, application log, debugger, or crash dump. See security and recovery.