In this lesson, you will learn how to secure your database credentials and configuration settings by using environment variables within your dbt deployment pipelines.
Moving Beyond Hardcoded Credentials
When you first start building dbt projects, it’s tempting to include your database username, password, or host address directly in your profiles.yml file. However, once you move toward automated deployments—like running your models via GitHub Actions—keeping plain-text secrets in your repository becomes a major security risk.
To solve this, we use environment variables. Instead of writing the secret directly into your configuration file, you define a placeholder that pulls the value from the machine’s local environment at runtime.
Implementing Variables in profiles.yml
In your profiles.yml, you can replace sensitive values with the env_var() Jinja function. For example, if you want to store your database password in a secure environment variable named DB_PASSWORD, your configuration would look like this:
my_project:
outputs:
prod:
type: snowflake
account: "{{ env_var('DB_ACCOUNT') }}"
user: "{{ env_var('DB_USER') }}"
password: "{{ env_var('DB_PASSWORD') }}"
...
How Deployment Pipelines Use This
When you set up your automated pipeline (such as a GitHub Action), you don't store these values in the code. Instead, you inject them using the platform's "Secrets" management system.
When the pipeline triggers a dbt run, the runner environment populates the variables defined in your secrets. dbt then calls env_var('DB_PASSWORD'), retrieves the value from the system memory, and authenticates with your data warehouse without the password ever being written to a disk or visible in your source control history.
This approach allows you to maintain a single project structure while using different environment variables for "dev," "staging," and "prod" targets. By decoupling your configuration from your code, you ensure that your credentials remain hidden even as your deployment processes become more automated and scalable.
Key Takeaway: Never hardcode sensitive credentials; use env_var() in your profiles.yml to inject secrets securely from your deployment environment at runtime.