title: How to specify sensitive environment variables at deploy time with Elastic Beanstalk
body: <p>I am deploying a Python Flask application with Elastic Beanstalk. I have a config file <code>/.ebextensions/01.config</code> where among other things I set some environment variables - some of which should be secret. </p>
  
  <p>The file looks something like this: </p>
  
  <pre><code>packages:
    yum:
      gcc: []
      git: []
      postgresql93-devel: []
  
  option_settings:
    "aws:elasticbeanstalk:application:environment":
      SECRET_KEY: "sensitive"
      MAIL_USERNAME: "sensitive"
      MAIL_PASSWORD: "sensitive"
      SQLALCHEMY_DATABASE_URI: "sensitive"
    "aws:elasticbeanstalk:container:python:staticfiles":
      "/static/": "app/static/"
  </code></pre>
  
  <p>What are the best practices for keeping certain values secret? Currently the <code>.ebextensions</code> folder is under source control and I like this because it is shared with everyone, but at the same time I do not want to keep sensitive values under source control.</p>
  
  <p>Is there a way to specify some environment variables through the EB CLI tool when deploying (e.g. <code>eb deploy -config ...</code>)? Or how is this use case covered by the AWS deployment tools? </p>