# Secure dbt profile which holds password

**URL:** <https://discourse.getdbt.com/t/secure-dbt-profile-which-holds-password/3276>\
**Category:** Archive\
**Created:** [November 2, 2021, 1:22am UTC](https://discourse.getdbt.com/t/secure-dbt-profile-which-holds-password/3276 "2021-11-02T01:22:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nsiddareddy](https://avatars.discourse-cdn.com/v4/letter/n/919ad9/32.png) [@nsiddareddy](https://discourse.getdbt.com/u/nsiddareddy)\
**Post date:** [November 2, 2021, 1:22am UTC](https://discourse.getdbt.com/t/secure-dbt-profile-which-holds-password/3276/1 "2021-11-02T01:22:41Z")

</div>

dbt profile holds passwords for db, what are some of the options to secure this file while the dbt has access to this file.

Can the profile be encrypted and let dbt decrypt?

Thanks  
Naveen

---

<div class="post-metadata">

**Author:** ![teguhn](https://avatars.discourse-cdn.com/v4/letter/t/3ec8ea/32.png) [@teguhn](https://discourse.getdbt.com/u/teguhn)\
**Post date:** [November 3, 2021, 5:39am UTC](https://discourse.getdbt.com/t/secure-dbt-profile-which-holds-password/3276/2 "2021-11-03T05:39:05Z")

</div>

You can set the password in environment variables and the dbt profile will get them automatically using `env_var()` function.

Reference: [env\_var | dbt Docs](https://docs.getdbt.com/reference/dbt-jinja-functions/env_var)

---

<div class="post-metadata">

**Author:** ![minsifye](https://avatars.discourse-cdn.com/v4/letter/m/d78d45/32.png) [@minsifye](https://discourse.getdbt.com/u/minsifye)\
**Post date:** [November 5, 2021, 1:52pm UTC](https://discourse.getdbt.com/t/secure-dbt-profile-which-holds-password/3276/3 "2021-11-05T13:52:47Z")

</div>

We generally use AWS KMS encryption for dbt profile file before adding it to version control, and while running DBT in AWS codebuild we decrypt the profile file. In general there is a shell script doing these operations. This way we keep our dev and prod profiles separated.