SOPS

Definition

SOPS, short for Secrets OPerationS, is an open-source command-line tool originally created at Mozilla that encrypts individual values within structured files such as YAML, JSON, and .env, rather than encrypting an entire file as an opaque blob, so encrypted secrets can still be safely stored and diffed in version control alongside application configuration. It integrates with key management systems like AWS KMS, Google Cloud KMS, Azure Key Vault, and PGP, delegating the actual encryption keys to those systems while SOPS handles the file-level encryption and decryption workflow.

Overview

Storing secrets safely alongside application code has long been a tension: keeping configuration in version control makes it easy to track changes and review them, but committing plaintext secrets to a repository is a serious security risk, while encrypting an entire file as a single blob makes it impossible to see what changed between commits or to review a pull request meaningfully. SOPS was created to resolve this tension by encrypting only the sensitive values within a structured file while leaving keys and file structure visible in plaintext. Mechanically, SOPS parses a YAML, JSON, .env, or similar structured file, walks its key-value pairs, and encrypts only the values, using a data encryption key that is itself encrypted with a key from an external key management system such as AWS KMS, GCP KMS, Azure Key Vault, or a PGP key pair. The result is a file that still looks structurally like the original, with keys and formatting intact, but where secret values appear as encrypted ciphertext strings. Because the structure remains visible, a diff of two versions of a SOPS-encrypted file clearly shows which keys changed even though the actual secret values remain unreadable without the decryption key. When an authorized user or system needs the real values, SOPS decrypts the file using access to the same key management system, either producing a decrypted file or streaming values directly to a consuming process. SOPS differs from a hosted secrets manager like Doppler or Infisical in that it is a file-encryption tool rather than a centralized service with its own access-control dashboard; there is no SOPS server, and access control is delegated entirely to whichever key management system backs it, such as AWS IAM policies controlling who can use a given KMS key. This makes SOPS a natural fit for GitOps-style workflows where configuration, including its encrypted secrets, lives directly in a Git repository rather than in a separate secrets management system. In practice, platform teams use SOPS to encrypt Kubernetes manifests, Terraform variable files, and application configuration committed to Git repositories, decrypting them automatically during CI/CD pipeline runs or via tools like the Flux GitOps operator that support SOPS-encrypted files natively. The main trade-off is that SOPS provides no built-in secret rotation, auditing dashboard, or dynamic credential generation the way dedicated secrets platforms do; it is purely an encryption mechanism for files, so organizations still need separate processes for rotating the underlying secret values and rely on their key management system's own audit logs to see who decrypted what.

Key Features

• Encrypts individual values within structured files rather than the whole file
• Preserves file structure so encrypted files remain diffable in Git
• Integrates with AWS KMS, GCP KMS, Azure Key Vault, and PGP
• Delegates access control to the backing key management system
• Supports YAML, JSON, .env, and other structured file formats
• Fits naturally into GitOps workflows storing config in version control
• Requires no dedicated server or hosted secrets dashboard
• Used natively by GitOps tools like Flux for encrypted manifests

Use Cases

Alternatives

Frequently Asked Questions

Related in DevOps