如何在NestJS模块中从AWS Secrets获取环境变量覆盖ConfigService？

我被这个问题困扰很久了。理想状态是让@nestjs/config的ConfigService先从文件系统读取.env获取基础环境变量（NODE_ENV、SECRETS_NAME/SECRETS_REGION），再调用AWS Secrets获取完整环境变量，返回一个全局可用的新ConfigService。但现在无法正确await秘密值的获取。

import { Module } from '@nestjs/common';
import { ConfigModule, ConfigService } from '@nestjs/config';
import { SecretsManager } from 'aws-sdk';
import * as dotenv from 'dotenv';
import * as fs from 'fs';
import * as path from 'path';

@Module({
  providers: [
    {
      provide: ConfigService,
      useFactory: async () => {
        console.log('initiating config..');
        try {
          const filePath = '../../.env';
          const envFile = path.resolve(
            __dirname,
            '../../',
            '.config',
            filePath,
          );
          const envConfig = dotenv.parse(fs.readFileSync(envFile));
          if (envConfig.NODE_ENV === 'local') {
            console.log('returning local');
            return new ConfigService({ envFilePath: '.env' });
          }
          const client = new SecretsManager({
            region: envConfig.SECRETS_REGION,
          });
          const secret = await client
            .getSecretValue({ SecretId: envConfig.SECRETS_NAME })
            .promise()
            .catch((err) => {
              console.log(err);
              return err;
            });
          const existingEnvVars = {
            NODE_ENV: envConfig.NODE_ENV,
            SECRETS_REGION: envConfig.SECRETS_REGION,
            SECRETS_NAME: envConfig.SECRETS_NAME,
          };
          const any = secret as any;
          const secrets = JSON.parse(any.SecretString ?? '');
          const fullVars = { ...existingEnvVars, ...secrets };
          return new ConfigService({
            envFilePath: undefined,
            ignoreEnvFile: true,
            load: [fullVars],
          });
        } catch (error) {
          console.error(`Error fetching user data: ${error.message}`);
          throw new Error(error);
        }
      },
    },
  ],
  exports: [ConfigService],
})
export class AppConfigModule {}

import { Module } from '@nestjs/common';
import { ConfigService } from '@nestjs/config';
import { AppConfigModule } from './config/appconfig.module';
import { OpenAIProvider } from './openai/openai';
import {
  TRANSCRIPTION_SERVICE,
  TranscriptionService,
} from './interfaces/transcription/transcription.service';
import { TranscriptionController } from './interfaces/transcription/transcription.controller';
import { OPENAI_SERVICE, OpenAIService } from './openai/openai.service';
import {
  CONVERSATION_SERVICE,
  ConversationService,
} from './interfaces/conversation/conversation.service';
import {
  HELPERS_SERVICE,
  HelpersService,
} from './common/helpers/helpers.service';
import { UsersService } from './interfaces/users/users.service';
import { UsersController } from './interfaces/users/users.controller';
import { AuthModule } from './auth/auth.module';
import { PostgresClient } from './database/PostgresClient';
import { DatabaseModule } from './database/database.module';
import { OpenaiModule } from './openai/openai.module';

@Module({
  imports: [AppConfigModule, DatabaseModule, AuthModule, OpenaiModule],
  controllers: [TranscriptionController, UsersController],
  providers: [
    OpenAIProvider,
    ConfigService,
    {
      provide: TRANSCRIPTION_SERVICE,
      useClass: TranscriptionService,
    },
    {
      provide: OPENAI_SERVICE,
      useClass: OpenAIService,
    },
    {
      provide: HELPERS_SERVICE,
      useClass: HelpersService,
    },
    {
      provide: CONVERSATION_SERVICE,
      useClass: ConversationService,
    },
    UsersService,
    PostgresClient,
  ],
  exports: [ConfigService],
})
export class AppModule {}

1. 移除AppModule中重复的ConfigService声明 #

你在AppModule的providers数组里重复添加了ConfigService，这会覆盖AppConfigModule导出的异步初始化实例。直接删除AppModule providers里的ConfigService即可，其他模块通过导入AppConfigModule就能使用正确的实例。

2. 修复AWS Secrets获取的错误处理逻辑 #

当前代码中client.getSecretValue().promise().catch()会把错误对象返回给secret变量，后续解析SecretString时会触发异常。应该移除catch，让错误进入外层try/catch统一处理：

const secret = await client.getSecretValue({ SecretId: envConfig.SECRETS_NAME }).promise();

3. 简化本地环境的ConfigService初始化 #

本地环境下直接用解析后的envConfig创建实例更可靠，无需重新指定envFilePath：

if (envConfig.NODE_ENV === 'local') {
  console.log('returning local');
  return new ConfigService(envConfig);
}

4. 完善AppConfigModule的依赖导入 #

在AppConfigModule的imports中添加ConfigModule.forRoot，确保ConfigService的基础依赖被正确初始化：

@Module({
  imports: [ConfigModule.forRoot({ isGlobal: false, ignoreEnvFile: true })],
  providers: [/* 原provider配置 */],
  exports: [ConfigService],
})
export class AppConfigModule {}

5. 确保其他模块异步依赖ConfigService #

如果其他模块需要使用AWS Secrets中的值，必须通过useFactory注入ConfigService并异步获取，避免在模块初始化阶段同步调用ConfigService.get()导致值未加载完成。

内容的提问来源于stack exchange，提问作者jawn