6.11 Variables in DevOps

DevOps work is full of environment-specific values — variables, in every sense (Python, OS environment, and Terraform), are how they’re managed instead of hardcoded.

Configuration Variables

Settings that differ per deployment (host, port, feature flags), typically loaded from a file or environment rather than hardcoded:

config = {
    "host": "localhost",
    "port": 8080,
    "debug": False,
}

Environment Variables

What Are They?

Values set in the OS environment, outside the Python script itself — the standard way to inject deployment-specific config (like which environment: dev/staging/prod) without changing code.

>>> import os
>>> os.environ.get("HOME")
'/root'
>>> os.environ.get("NOT_SET", "default_value")
'default_value'

Secrets

What Is It?

Sensitive values (API keys, passwords, tokens) that must never be hardcoded into source code.

Why Does It Matter?

Hardcoded secrets end up in version control history permanently — even if removed in a later commit, they remain recoverable from the git history.

How Is It Used?

Load from environment variables or a dedicated secrets manager (AWS Secrets Manager, HashiCorp Vault) at runtime instead:

import os

api_key = os.environ.get("API_KEY")   # never: api_key = "sk-abc123..."
if not api_key:
    raise RuntimeError("API_KEY environment variable not set")

AWS Credentials

boto3 automatically reads AWS credentials from environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) or the shared ~/.aws/credentials file — a script’s own variables typically never touch the raw credentials directly:

import boto3

# boto3 picks up credentials from the environment/config automatically --
# no credentials appear as literal variables in the script itself
s3 = boto3.client("s3")

Terraform Variables

Terraform has its own variable system (variable blocks in .tf files), conceptually similar to Python variables — named, typed placeholders for values that differ per environment, such as instance_type or region.

Quick Interview Answer

“DevOps scripts lean on three layers of variables: Python variables for in-script logic, OS environment variables (os.environ) for deployment-specific config injected without changing code, and infrastructure-as-code variables like Terraform’s variable blocks for the same idea at the infrastructure layer. Secrets specifically should never be hardcoded as Python literals — they belong in environment variables or a dedicated secrets manager, since a hardcoded secret remains recoverable from git history even after being removed in a later commit.”

Common Mistakes

• Hardcoding an API key or password directly as a string literal — it persists in version control history indefinitely, even after later “removing” it.
• Not providing a default with os.environ.get(name, default) and instead using os.environ[name], which raises an unhandled KeyError if the variable isn’t set.
• Assuming boto3 needs credentials passed explicitly as variables in code — it resolves them automatically from the environment or ~/.aws/credentials unless overridden.