environment variable for token in yaml file

Hi @rawvarun,

Yes, you typically can reference environment variables in your YAML configuration, but it depends on how the YAML file is processed by the AEM environment or the underlying system.

When setting up Splunk with AEM as a Cloud Service, the Adobe Experience League guide usually suggests configuring logging or data forwarding using files like splunk.yaml or through the Adobe Cloud Manager environment.

To keep things secure, it’s best not to hardcode sensitive tokens - like the Splunk HEC token - directly in the YAML file. Instead, using environment variables is recommended because it helps keep these secrets out of your source code and makes them easier to manage securely.

Refer below steps to use environment variables in YAML:

1. Plain YAML files themselves do not support environment variable expansion by default.
   YAML is just a data serialization format. To inject environment variables into YAML files, the application reading the YAML must support environment variable substitution.

2. In AEM as a Cloud Service:

   • Adobe Cloud Manager supports injecting environment variables into your runtime environment.

   • You can define environment variables in the Adobe Cloud Manager UI or via the Cloud Manager API.

   • Your application code or service that reads the splunk.yaml should be able to read these environment variables at runtime.

3. Common approaches:

   • Option 1: Use placeholders in YAML and replace them during build/deploy process.
     Eg. in splunk.yaml:

     ${SPLUNK_TOKEN}

     And then during deployment, a script or the platform replaces ${SPLUNK_TOKEN} with the actual value from environment variables.

   • Option 2: Read the token directly from environment variables in code/config.
     If the YAML is for a service that supports environment variable expansion (like some Docker setups or Helm charts), it may work directly.

Per Adobe docs generally recommend not hardcoding tokens in configuration files but managing secrets using:

• Adobe Cloud Manager environment variables for sensitive data.

• Using AEM's secure vault or secrets management (for local dev and some environments).

• Injecting tokens securely during deployment.

Hope that helps!

@rawvarun 

Please refer to the documentation for examples

https://docs.axway.com/bundle/axway-open-docs/page/docs/apim_yamles/yamles_environmentalization/index.html 

Hi @rawvarun ,

Try below steps:

1. Create a Template YAML File

This file contains a placeholder for the environment variable.

File: splunk.template.yaml

2. Define the Environment Variable

In Adobe Cloud Manager:

Go to Cloud Manager UI => your Pipeline => Edit Variables

Add a variable:

  - Name: SPLUNK_TOKEN

  - Value: your actual HEC token

  - Mark it as secret (this keeps it hidden and secure)

3. Replace Placeholders During Build

In your Cloud Manager pipeline, you can add a custom script step using a shell script to perform substitution.

Script: replace-vars.sh

Ensure this script is executable:

Regards,
Amit

Hi @rawvarun 

The key is defining the Environment Variable and marking the scope for "all" services. Then using the syntax like this: ${{MY_VAR}}

Hope this helps

@rawvarun Just checking in — were you able to resolve your issue?
We’d love to hear how things worked out. If the suggestions above helped, marking a response as correct can guide others with similar questions. And if you found another solution, feel free to share it — your insights could really benefit the community. Thanks again for being part of the conversation!