I am facing the same issue. I want to fetch db credentials from Azure Key Vault (same as AWS Secret Manager) and cannot do that... 🥲

I tried to wrap a promise around it but couldn't get it to work either. Any thoughts?

import type { Config } from "drizzle-kit";
import { getDatabaseConnectionString } from "./src/db/utils.js";

const connectionStringPromise = getDatabaseConnectionString();

const configPromise: Promise<Config> = (async () => {
  const connectionString = await connectionStringPromise;
  return {
    schema: "./src/db/schema.ts",
    out: "./src/db/migrations",
    driver: "pg",
    dbCredentials: {
      connectionString,
    },
  };
})();

export default configPromise;

I am also having this issue. I am attempting to pull secrets from AWS Secrets manager in my JavaScript and I need top-level await to do that with Drizzle Kit's configuration file. I will have to abandon this strategy and instead use the AWS SDK for Linux to pull and set the environment variables at the OS level. Would be nice for top-level wait to be supported.

Workaround:

const getConfig = async () => {
  // simplified
  const dbURL = await getSecret(process.env.DB_CREDENTIALS_SECRET);

  return defineConfig({
    schema: './src/schema.ts',
    out: './drizzle',
    dialect: 'postgresql',
    dbCredentials: {
      url: dbURL,
    },
  });
};

export default getConfig();

But naturally would be great to just use top-level await.

@paolostyle wouldn't the last line of your code snippet need await?

export default await getConfig();

Since getConfig is an async function, doesn't it need to be awaited?

No, it doesn't. You don't ever have to await an async function, even though you probably should in most cases, but this is a config file processed by external code (drizzle-kit in this case). Considering it works, it likely awaits whatever is exported by the config file. I can't check it because a) drizzle-kit isn't open-sourced b) it's quite likely that the config part is handled by an external dependency c) I don't really have time to do that.

That snippet isn't something I would use in my regular code but as I said, it's a workaround.

Async config works for drizzle-kit migrate/studio but not drizzle-kit generate/check, unfortunately:

ZodError: [
  {
    "code": "invalid_type",
    "expected": "object",
    "received": "promise",
    "path": [],
    "message": "Expected object, received promise"
  }
]

Current (terrible) workaround:

// drizzle.credentials.ts

import { CONNECTION_STRING } from './some-file-with-top-level-await.js';

console.log(CONNECTION_STRING);

// drizzle.config.ts

import { execSync } from 'node:child_process';
import { createRequire } from 'node:module';

import type { Config } from 'drizzle-kit';

const require = createRequire(import.meta.url);

const CONNECTION_STRING = execSync(
  `tsx --no-warnings ${require.resolve('./drizzle.credentials.ts')}`,
  { encoding: 'utf8' },
).trim();

export default {
  dbCredentials: { url: CONNECTION_STRING },
  // ...
} satisfies Config;

I'm having the same issue as well, this seems like a very common use case, storing secrets in .env files is hard to share and keep out of version control than just using a better approach like using a secrets manager.

Another workaround which doesn't require a code change is to run the migration while setting the env variable in the same command:

Mac Terminal command:

$ DATABASE_URL='your-db-url' npx drizzle-kit generate

Can't wait for this feature... It seems totally essential for any secrets manager.

Async config works for drizzle-kit migrate/studio but not drizzle-kit generate/check, unfortunately:

ZodError: [
  {
    "code": "invalid_type",
    "expected": "object",
    "received": "promise",
    "path": [],
    "message": "Expected object, received promise"
  }
]

Current (terrible) workaround:

// drizzle.credentials.ts

import { CONNECTION_STRING } from './some-file-with-top-level-await.js';

console.log(CONNECTION_STRING);

// drizzle.config.ts

import { execSync } from 'node:child_process';
import { createRequire } from 'node:module';

import type { Config } from 'drizzle-kit';

const require = createRequire(import.meta.url);

const CONNECTION_STRING = execSync(
  `tsx --no-warnings ${require.resolve('./drizzle.credentials.ts')}`,
  { encoding: 'utf8' },
).trim();

export default {
  dbCredentials: { url: CONNECTION_STRING },
  // ...
} satisfies Config;

As an alternative way of requesting secrets from the vault.

// drizzle.secrets.ts
import { getSecrets } from './get-secrets.ts'

const secrets = await getSecrets()

console.log(JSON.stringify(secrets))

// drizzle.config.ts
import { defineConfig } from 'drizzle-kit'

Object.assign(process.env, JSON.parse(process.env.SECRETS))

export default defineConfig({
    schema: "./src/db/schema.ts",
    out: "./src/db/migrations",
    driver: "pg",
    dbCredentials: {
      url: process.env.DATABASE_URL,
    },
  })

package.json

"db:migrate": "SECRETS=$(tsx --no-warnings './drizzle.secrets.ts') drizzle-kit migrate --config=drizzle.config.ts"

looks like not drizzle issue
you package is CJS which sync