diff --git a/app/__init__.py b/app/__init__.py
index 43e7fa659..41891f599 100644
--- a/app/__init__.py
+++ b/app/__init__.py
@@ -15,7 +15,7 @@ ma = Marshmallow()
 api_user = LocalProxy(lambda: _request_ctx_stack.top.api_user)
 
 
-def create_app(config_name):
+def create_app(config_name, config_overrides=None):
     application = Flask(__name__)
 
     application.config['NOTIFY_API_ENVIRONMENT'] = config_name
@@ -23,7 +23,7 @@ def create_app(config_name):
 
     db.init_app(application)
     ma.init_app(application)
-    init_app(application)
+    init_app(application, config_overrides)
     logging.init_app(application)
 
     from app.service.rest import service as service_blueprint
@@ -41,11 +41,16 @@ def create_app(config_name):
     return application
 
 
-def init_app(app):
+def init_app(app, config_overrides):
     for key, value in app.config.items():
         if key in os.environ:
             app.config[key] = convert_to_boolean(os.environ[key])
 
+    if config_overrides:
+        for key in app.config.keys():
+            if key in config_overrides:
+                    app.config[key] = config_overrides[key]
+
     @app.before_request
     def required_authentication():
         from app.authentication import auth
diff --git a/db.py b/db.py
new file mode 100644
index 000000000..7dab633c3
--- /dev/null
+++ b/db.py
@@ -0,0 +1,15 @@
+from flask.ext.script import Manager, Server
+from flask_migrate import Migrate, MigrateCommand
+from app import create_app, db
+from credstash import getAllSecrets
+
+secrets = getAllSecrets(region="eu-west-1")
+
+application = create_app('live', secrets)
+
+manager = Manager(application)
+migrate = Migrate(application, db)
+manager.add_command('db', MigrateCommand)
+
+if __name__ == '__main__':
+    manager.run()
diff --git a/requirements.txt b/requirements.txt
index d76120cfd..529d8c18b 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -11,6 +11,7 @@ marshmallow-sqlalchemy==0.8.0
 flask-marshmallow==0.6.2
 itsdangerous==0.24
 Flask-Bcrypt==0.6.2
+credstash==1.8.0
 
 git+https://github.com/alphagov/notifications-python-client.git@0.1.5#egg=notifications-python-client==0.1.5
 
diff --git a/scripts/aws_install_dependencies.sh b/scripts/aws_install_dependencies.sh
index 444f679e1..c080296ee 100755
--- a/scripts/aws_install_dependencies.sh
+++ b/scripts/aws_install_dependencies.sh
@@ -1 +1,4 @@
+echo "Install dependencies"
+cd /home/ubuntu/notifications-api;
 pip3 install -r /home/ubuntu/notifications-api/requirements.txt
+python3 db.py db upgrade
diff --git a/wsgi.py b/wsgi.py
index febb098ce..138a48c6f 100644
--- a/wsgi.py
+++ b/wsgi.py
@@ -1,6 +1,9 @@
 from app import create_app
+from credstash import getAllSecrets
 
-application = create_app('live')
+secrets = getAllSecrets(region="eu-west-1")
+
+application = create_app('live', secrets)
 
 if __name__ == "__main__":
         application.run()