A ~10-minute, copy-paste tutorial that takes you from an empty directory to a fully working Clef setup, then deploys the production secrets to AWS Secrets Manager via the @clef-sh/cdk constructs.

By the end, you'll have:

A clef.yaml with two namespaces ( database , payments ) across two environments ( dev , production )

All four matrix cells populated with demo secrets, encrypted with SOPS

A service identity ( app ) whose production envelope is protected by AWS KMS

A CloudFormation stack with three ClefSecret s, each holding a Clef-managed value in AWS Secrets Manager — readable by your app via the standard ASM SDK, with no Clef agent at runtime

Steps 1–3 work fully offline. Steps 4–5 deploy real AWS resources and require working AWS credentials.

Prerequisites

Node.js 20+

AWS account + credentials for steps 4–5 only. Standard SDK resolution applies ( AWS_PROFILE , env vars, SSO, etc.).…