Skip to main content

atmos secret delete

Remove a declared secret's value from its configured backend. Atmos prompts for confirmation before deleting unless you pass --force. The secret declaration in your stack configuration is not modified — only the stored value is removed. Pass --all to clear every declared secret for the scope (a clean, in-process reset of a SOPS file). This command is also available under the rm and unset aliases.

atmos secret delete --help

Usage​

atmos secret delete NAME [flags]
atmos secret delete --all [flags]

Deleting is scope-aware. For a named stack-scoped secret or a secret declared with scope: global, you may omit --component; with --all, only the stack's stack-scoped and global secrets are deleted. Atmos verifies that the declaration and provider agree across components, and asks for --component when they do not or when the secret is instance-scoped. See Secret scopes.

--all cannot be combined with a NAME. A global secret is one value shared by every stack that uses its backend, so deleting it (by name or with --all) removes it for all of those stacks, not only the selected one.

Examples​

# Delete a secret value, prompting for confirmation
atmos secret delete DATADOG_API_KEY --stack=prod --component=api

# A stack-scoped or global secret does not require a component
atmos secret delete SHARED_API_KEY --stack=prod

# Delete without a confirmation prompt
atmos secret delete DATADOG_API_KEY --stack=prod --component=api --force

# Clear ALL declared secrets for the scope (resets a SOPS file to a clean state)
atmos secret delete --all --force --stack=prod --component=api

# Use the `rm` alias
atmos secret rm DATADOG_API_KEY --stack=prod --component=api

# Use the `unset` alias
atmos secret unset DATADOG_API_KEY --stack=prod --component=api

# Delete using a specific identity for the backend
atmos secret delete DATADOG_API_KEY --stack=prod --component=api --identity=aws/prod-secrets

Arguments​

NAME

The name of the declared secret whose value is removed.

Flags​

--stack (alias -s)

The Atmos stack to operate on. Required.

Environment variable: ATMOS_STACK

--component (alias -c)

The Atmos component that declares the secret. Optional for stack-scoped and global secrets (see Secret scopes); required for instance-scoped secrets.

Environment variable: ATMOS_COMPONENT

--type

The component type (terraform, helmfile, packer, or ansible). Used to disambiguate when a component name exists in more than one type.

--identity (alias -i)

The identity to use when accessing the secret backend.

Environment variable: ATMOS_IDENTITY

--force (alias -f)

Delete the value without prompting for confirmation. Required when there is no interactive terminal (CI, pipes, scripts); without it the command fails with an interactive mode not available error that hints at --force.

--all

Delete every declared secret's value for the scope instead of a single NAME. For a SOPS file this resets it to a clean state in-process. The NAME argument is omitted when --all is used.

See Also​