Secrets & Hot Reload

Preview — 3 of 10 questions

You load secrets from AWS Secrets Manager at boot. Which approach correctly integrates them into ConfigModule?

javascript

ConfigModule.forRoot({
  isGlobal: true,
  load: [
    async () => {
      const secret = await secretsClient.getSecretValue({ SecretId: 'prod/db' });
      const parsed = JSON.parse(secret.SecretString ?? '{}');
      return { database: { url: parsed.DATABASE_URL } };
    },
  ],
});

AHardcode the secrets and rotate them by redeploying

BPut the secret values directly in .env and commit them

CCall the secrets manager inside every controller method on demand

DUse ConfigModule.forRootAsync with a load factory (or async useFactory) that awaits the secrets-manager SDK and returns a merged config object

When loading config over HTTP in forRootAsync useFactory, what reliability concern is most important?

javascript

useFactory: async () => {
  const res = await fetch(CONFIG_URL, { signal: AbortSignal.timeout(5000) });
  if (!res.ok) throw new Error(`Config fetch failed: ${res.status}`);
  return (await res.json()) as RemoteConfig;
},
type RemoteConfig = Record<string, unknown>;

ANothing — HTTP at boot is always reliable

BThe fetch must have a timeout and a fallback/retry strategy, because a hung remote call blocks the entire application bootstrap

CYou must disable validation when using remote config

DRemote config must be loaded with eval

You want to reload certain config values without restarting. What is a sound design within Nest?

javascript

@Injectable()
export class DynamicConfig implements OnModuleInit {
  private readonly value$ = new BehaviorSubject<AppConfig>(defaultConfig);
  onModuleInit(): void {
    fs.watch(CONFIG_PATH, () => this.reload());
  }
  get snapshot(): AppConfig { return this.value$.value; }
  private reload(): void { this.value$.next(this.loadAndValidate()); }
  private loadAndValidate(): AppConfig {/* ... */ return defaultConfig; }
}
declare const defaultConfig: AppConfig;
type AppConfig = Record<string, unknown>;

AMutate process.env directly and rely on ConfigService re-reading it

BRe-run ConfigModule.forRoot() at runtime

CMaintain a dedicated, injectable config holder service that watches the file/source and updates an internal observable value consumers subscribe to or re-read

DRestart the process on every change anyway

Answer all 10 questions (7 more), see explanations for every answer, and track your score.