Environment Variables

Overview

Multi-Cloud Manager requires environment variables to authenticate with Azure, Google Cloud Platform (GCP), and Amazon Web Services (AWS). All variables should be defined in a .env file in the root directory.

Environment File Setup

Create a .env file in the project root:

touch .env

The .env file is automatically loaded by the backend service through the docker-compose.yml configuration:

backend:
  env_file:
    - .env

Required Environment Variables

Azure Configuration

Required for Azure cloud operations and authentication:

Variable	Description	Required	Example
`AZURE_CLIENT_ID`	Azure AD application (client) ID	Yes	`a1b2c3d4-e5f6-7g8h-9i0j-k1l2m3n4o5p6`
`AZURE_CLIENT_SECRET`	Azure AD application client secret	Yes	`abc123~DEF456.ghi789_JKL012`
`AZURE_TENANT_ID`	Azure AD tenant (directory) ID	Yes	`z9y8x7w6-v5u4-t3s2-r1q0-p9o8n7m6l5k4`
`FRONTEND_URL`	Frontend application URL	No	`http://localhost:3000` (default)
`APP_BASE_URL`	Backend application base URL	No	`http://localhost:5000` (default)

Used in:

azure_modules/utils.py:16-19
azure_modules/log_analytics.py:28-30
azure_modules/containermonitor.py:20-22
azure_modules/alerts.py:20-22
auth/azure_auth.py:11-15

Google Cloud Platform (GCP) Configuration

Required for GCP operations and OAuth authentication:

Variable	Description	Required	Example
`GOOGLE_CLIENT_ID`	GCP OAuth 2.0 client ID	Yes	`123456789-abc123def456.apps.googleusercontent.com`
`GOOGLE_CLIENT_SECRET`	GCP OAuth 2.0 client secret	Yes	`GOCSPX-AbCdEfGhIjKlMnOpQrStUvWxYz`
`GOOGLE_REDIRECT_URI`	OAuth redirect URI for GCP authentication	Yes	`http://localhost:5000/auth/google/callback`

Used in:

gcp/utils.py:8-9
auth/gcp_auth.py:7-9

Amazon Web Services (AWS) Configuration

Required for AWS operations:

Variable	Description	Required	Example
`AWS_ACCESS_KEY_ID`	AWS IAM access key ID	Yes	`AKIAIOSFODNN7EXAMPLE`
`AWS_SECRET_ACCESS_KEY`	AWS IAM secret access key	Yes	`wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY`
`AWS_ACCOUNT_ID`	AWS account ID	Yes	`123456789012`

Used in:

aws/utils.py:5-6
auth/aws_auth.py:10-12

Example .env File

Here’s a complete example .env file with all required variables:

# Azure Configuration
AZURE_CLIENT_ID=a1b2c3d4-e5f6-7g8h-9i0j-k1l2m3n4o5p6
AZURE_CLIENT_SECRET=abc123~DEF456.ghi789_JKL012
AZURE_TENANT_ID=z9y8x7w6-v5u4-t3s2-r1q0-p9o8n7m6l5k4
FRONTEND_URL=http://localhost:3000
APP_BASE_URL=http://localhost:5000

# Google Cloud Platform Configuration
GOOGLE_CLIENT_ID=123456789-abc123def456.apps.googleusercontent.com
GOOGLE_CLIENT_SECRET=GOCSPX-AbCdEfGhIjKlMnOpQrStUvWxYz
GOOGLE_REDIRECT_URI=http://localhost:5000/auth/google/callback

# Amazon Web Services Configuration
AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
AWS_ACCOUNT_ID=123456789012

Setting Up Cloud Provider Credentials

Azure Setup

Register an Application in Azure AD:
- Go to Azure Portal > Azure Active Directory > App registrations
- Click “New registration”
- Note the Application (client) ID and Directory (tenant) ID
Create a Client Secret:
- In your app registration, go to Certificates & secrets
- Click “New client secret”
- Copy the secret value immediately (it won’t be shown again)
Configure API Permissions:
- Add required Azure management API permissions
- Grant admin consent for your organization
Set Redirect URIs:
- Add http://localhost:5000/auth/azure/callback for development
- Add your production callback URL for production

Google Cloud Platform Setup

Create a GCP Project:
- Go to Google Cloud Console
- Create a new project or select existing one
Enable Required APIs:
- Enable Cloud Resource Manager API
- Enable Compute Engine API
- Enable Cloud Run API
- Enable Cloud Monitoring API
- Enable Cloud Logging API
Create OAuth 2.0 Credentials:
- Go to APIs & Services > Credentials
- Click “Create Credentials” > “OAuth 2.0 Client ID”
- Configure OAuth consent screen
- Note the Client ID and Client Secret
Configure Authorized Redirect URIs:
- Add http://localhost:5000/auth/google/callback for development
- Add your production callback URL for production

AWS Setup

Create an IAM User:
- Go to AWS IAM Console
- Click “Users” > “Add user”
- Enable “Programmatic access”
Attach Policies:
- Attach required policies for EC2, S3, and other services
- Consider using managed policies or create custom policies
Generate Access Keys:
- In the user’s Security credentials tab
- Click “Create access key”
- Download and securely store the credentials
Note Your Account ID:
- Find your AWS Account ID in the account dropdown

Security Best Practices

Development Environment

Never Commit .env Files:

# Add to .gitignore
.env
.env.local
.env.*.local

Use Environment-Specific Files:
- .env.development for development
- .env.production for production
- .env.test for testing
Limit Credential Permissions:
- Use least privilege principle
- Create separate credentials for development and production

Production Environment

Use Secret Management Services:
- Azure Key Vault for Azure deployments
- Google Secret Manager for GCP deployments
- AWS Secrets Manager for AWS deployments
- HashiCorp Vault for multi-cloud

Use Docker Secrets:

secrets:
  azure_client_secret:
    external: true

services:
  backend:
    secrets:
      - azure_client_secret

Rotate Credentials Regularly:
- Set up automatic rotation schedules
- Monitor for unauthorized access
Use Environment Variables in CI/CD:
- Store secrets in GitHub Secrets, GitLab CI/CD variables, etc.
- Never hardcode credentials in deployment scripts

Validation

After setting up environment variables, verify they’re loaded correctly:

Check Environment Variables in Container

# Access backend container
docker-compose exec backend /bin/bash

# List environment variables (be careful with sensitive data)
env | grep AZURE
env | grep GOOGLE
env | grep AWS

Test Authentication

Start the application and check logs:

docker-compose up

Look for authentication-related errors in the backend logs. If credentials are missing or invalid, you’ll see error messages.

Troubleshooting