diff --git a/Makefile b/Makefile
index 065882d..6c17103 100644
--- a/Makefile
+++ b/Makefile
@@ -20,14 +20,25 @@ ANALYTICS_WRITE_KEY ?=
 LDFLAGS := -ldflags='-X "main.Version=$(VERSION)" -X "main.AnalyticsWriteKey=$(ANALYTICS_WRITE_KEY)"'
 MOQ := $(shell command -v moq 2> /dev/null)
 SRC := $(shell find . -name '*.go')
+GOLANGCI_LINT := $(shell command -v golangci-lint 2> /dev/null)
+
+vet:
+	go vet ./...
 
 test: store/awsapi_mock.go
 	go test -v ./...
 
-.PHONY: coverage
 coverage:
 	go test -coverpkg ./... -coverprofile coverage.out ./...
 
+lint: vet
+ifdef GOLANGCI_LINT
+	@golangci-lint run --max-same-issues 0 --max-issues-per-linter 0
+else
+	@echo "Please install golangci-lint: brew install golangci-lint"
+	@false
+endif
+
 store/awsapi_mock.go: store/awsapi.go
 ifdef MOQ
 	rm -f $@
@@ -71,4 +82,4 @@ dist/chamber-$(VERSION)-linux-arm64 dist/chamber-$(VERSION)-linux-aarch64: | dis
 dist/chamber-$(VERSION)-windows-amd64.exe: | dist/
 	GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go build -trimpath $(LDFLAGS) -o $@
 
-.PHONY: clean all fmt build linux
+.PHONY: vet test coverage lint clean all fmt build linux
diff --git a/cmd/delete.go b/cmd/delete.go
index 620b276..d31a711 100644
--- a/cmd/delete.go
+++ b/cmd/delete.go
@@ -40,7 +40,7 @@ func delete(cmd *cobra.Command, args []string) error {
 	}
 
 	if analyticsEnabled && analyticsClient != nil {
-		analyticsClient.Enqueue(analytics.Track{
+		_ = analyticsClient.Enqueue(analytics.Track{
 			UserId: username,
 			Event:  "Ran Command",
 			Properties: analytics.NewProperties().
diff --git a/cmd/env.go b/cmd/env.go
index 71227d0..9ac7f50 100644
--- a/cmd/env.go
+++ b/cmd/env.go
@@ -75,7 +75,7 @@ func exportEnv(cmd *cobra.Command, args []string) ([]string, error) {
 	}
 
 	if analyticsEnabled && analyticsClient != nil {
-		analyticsClient.Enqueue(analytics.Track{
+		_ = analyticsClient.Enqueue(analytics.Track{
 			UserId: username,
 			Event:  "Ran Command",
 			Properties: analytics.NewProperties().
diff --git a/cmd/env_test.go b/cmd/env_test.go
index 4dcf969..2f489d0 100644
--- a/cmd/env_test.go
+++ b/cmd/env_test.go
@@ -1,7 +1,6 @@
 package cmd
 
 import (
-	"fmt"
 	"testing"
 )
 
@@ -35,7 +34,7 @@ func Test_sanitizeKey(t *testing.T) {
 	}{
 		{given: "invalid strings", expected: "invalid_strings"},
 		{given: "extremely  invalid  strings", expected: "extremely__invalid__strings"},
-		{given: fmt.Sprintf("\nunbelievably\tinvalid\tstrings\n"), expected: "unbelievably_invalid_strings"},
+		{given: "\nunbelievably\tinvalid\tstrings\n", expected: "unbelievably_invalid_strings"},
 		{given: "valid_string", expected: "valid_string"},
 		{given: "validish-string", expected: "validish_string"},
 		{given: "valid.string", expected: "valid_string"},
diff --git a/cmd/exec.go b/cmd/exec.go
index 64b932d..1475441 100644
--- a/cmd/exec.go
+++ b/cmd/exec.go
@@ -75,7 +75,7 @@ func execRun(cmd *cobra.Command, args []string) error {
 	services, command, commandArgs := args[:dashIx], args[dashIx], args[dashIx+1:]
 
 	if analyticsEnabled && analyticsClient != nil {
-		analyticsClient.Enqueue(analytics.Track{
+		_ = analyticsClient.Enqueue(analytics.Track{
 			UserId: username,
 			Event:  "Ran Command",
 			Properties: analytics.NewProperties().
@@ -118,9 +118,8 @@ func execRun(cmd *cobra.Command, args []string) error {
 		}
 		for _, service := range services {
 			collisions := make([]string, 0)
-			var err error
 			// TODO: these interfaces should look the same as Strict*, so move pristine in there
-			err = env.Load(cmd.Context(), secretStore, service, &collisions)
+			err := env.Load(cmd.Context(), secretStore, service, &collisions)
 			if err != nil {
 				return fmt.Errorf("Failed to list store contents: %w", err)
 			}
diff --git a/cmd/export.go b/cmd/export.go
index 6972725..bcafd43 100644
--- a/cmd/export.go
+++ b/cmd/export.go
@@ -42,7 +42,7 @@ func runExport(cmd *cobra.Command, args []string) error {
 	var err error
 
 	if analyticsEnabled && analyticsClient != nil {
-		analyticsClient.Enqueue(analytics.Track{
+		_ = analyticsClient.Enqueue(analytics.Track{
 			UserId: username,
 			Event:  "Ran Command",
 			Properties: analytics.NewProperties().
@@ -82,6 +82,7 @@ func runExport(cmd *cobra.Command, args []string) error {
 		if file, err = os.OpenFile(exportOutput, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0644); err != nil {
 			return fmt.Errorf("Failed to open output file for writing: %w", err)
 		}
+		// TODO: check for errors flushing, syncing, or closing
 		defer file.Close()
 		defer file.Sync()
 	}
@@ -144,7 +145,10 @@ func exportAsTFvars(params map[string]string, w io.Writer) error {
 	for _, k := range sortedKeys(params) {
 		key := sanitizeKey(strings.TrimPrefix(k, "tf_var_"))
 
-		w.Write([]byte(fmt.Sprintf(`%s = "%s"`+"\n", key, doubleQuoteEscape(params[k]))))
+		_, err := w.Write([]byte(fmt.Sprintf(`%s = "%s"`+"\n", key, doubleQuoteEscape(params[k]))))
+		if err != nil {
+			return fmt.Errorf("failed to write variable with key %s: %v", k, err)
+		}
 	}
 	return nil
 }
@@ -170,7 +174,10 @@ func exportAsJavaProperties(params map[string]string, w io.Writer) error {
 	p := properties.NewProperties()
 	p.DisableExpansion = true
 	for _, k := range sortedKeys(params) {
-		p.Set(k, params[k])
+		_, _, err := p.Set(k, params[k])
+		if err != nil {
+			return fmt.Errorf("failed to set property %s: %v", k, err)
+		}
 	}
 
 	// Java expects properties in ISO-8859-1 by default
diff --git a/cmd/history.go b/cmd/history.go
index 6d8c1e5..0f887a8 100644
--- a/cmd/history.go
+++ b/cmd/history.go
@@ -35,7 +35,7 @@ func history(cmd *cobra.Command, args []string) error {
 	}
 
 	if analyticsEnabled && analyticsClient != nil {
-		analyticsClient.Enqueue(analytics.Track{
+		_ = analyticsClient.Enqueue(analytics.Track{
 			UserId: username,
 			Event:  "Ran Command",
 			Properties: analytics.NewProperties().
diff --git a/cmd/import.go b/cmd/import.go
index dc92c61..91bec26 100644
--- a/cmd/import.go
+++ b/cmd/import.go
@@ -54,7 +54,7 @@ func importRun(cmd *cobra.Command, args []string) error {
 	}
 
 	if analyticsEnabled && analyticsClient != nil {
-		analyticsClient.Enqueue(analytics.Track{
+		_ = analyticsClient.Enqueue(analytics.Track{
 			UserId: username,
 			Event:  "Ran Command",
 			Properties: analytics.NewProperties().
diff --git a/cmd/list.go b/cmd/list.go
index f65dd2c..4f20ede 100644
--- a/cmd/list.go
+++ b/cmd/list.go
@@ -43,7 +43,7 @@ func list(cmd *cobra.Command, args []string) error {
 	}
 
 	if analyticsEnabled && analyticsClient != nil {
-		analyticsClient.Enqueue(analytics.Track{
+		_ = analyticsClient.Enqueue(analytics.Track{
 			UserId: username,
 			Event:  "Ran Command",
 			Properties: analytics.NewProperties().
diff --git a/cmd/read.go b/cmd/read.go
index 3a54822..ac62324 100644
--- a/cmd/read.go
+++ b/cmd/read.go
@@ -42,7 +42,7 @@ func read(cmd *cobra.Command, args []string) error {
 	}
 
 	if analyticsEnabled && analyticsClient != nil {
-		analyticsClient.Enqueue(analytics.Track{
+		_ = analyticsClient.Enqueue(analytics.Track{
 			UserId: username,
 			Event:  "Ran Command",
 			Properties: analytics.NewProperties().
diff --git a/cmd/root.go b/cmd/root.go
index 8a97127..334e9a8 100644
--- a/cmd/root.go
+++ b/cmd/root.go
@@ -105,7 +105,7 @@ func Execute(vers string, writeKey string) {
 
 	if cmd, err := RootCmd.ExecuteC(); err != nil {
 		if strings.Contains(err.Error(), "arg(s)") || strings.Contains(err.Error(), "usage") {
-			cmd.Usage()
+			_ = cmd.Usage()
 		}
 		os.Exit(1)
 	}
@@ -206,7 +206,8 @@ func getSecretStore(ctx context.Context) (store.Store, error) {
 			return nil, errors.New("Unable to use --kms-key-alias with this backend. Use CHAMBER_KMS_KEY_ALIAS instead.")
 		}
 
-		parsedRetryMode, err := aws.ParseRetryMode(retryMode)
+		var parsedRetryMode aws.RetryMode
+		parsedRetryMode, err = aws.ParseRetryMode(retryMode)
 		if err != nil {
 			return nil, fmt.Errorf("Invalid retry mode %s", retryMode)
 		}
@@ -225,7 +226,7 @@ func prerun(cmd *cobra.Command, args []string) {
 		})
 
 		username = os.Getenv("USER")
-		analyticsClient.Enqueue(analytics.Identify{
+		_ = analyticsClient.Enqueue(analytics.Identify{
 			UserId: username,
 			Traits: analytics.NewTraits().
 				Set("chamber-version", chamberVersion),
diff --git a/cmd/version.go b/cmd/version.go
index d1f3840..a414959 100644
--- a/cmd/version.go
+++ b/cmd/version.go
@@ -22,7 +22,7 @@ func init() {
 func versionRun(cmd *cobra.Command, args []string) error {
 	fmt.Fprintf(os.Stdout, "chamber %s\n", chamberVersion)
 	if analyticsEnabled && analyticsClient != nil {
-		analyticsClient.Enqueue(analytics.Track{
+		_ = analyticsClient.Enqueue(analytics.Track{
 			UserId: username,
 			Event:  "Ran Command",
 			Properties: analytics.NewProperties().
diff --git a/cmd/write.go b/cmd/write.go
index 424e8a9..70f37f7 100644
--- a/cmd/write.go
+++ b/cmd/write.go
@@ -3,7 +3,7 @@ package cmd
 import (
 	"bufio"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"os"
 	"strings"
 
@@ -44,7 +44,7 @@ func write(cmd *cobra.Command, args []string) error {
 	}
 
 	if analyticsEnabled && analyticsClient != nil {
-		analyticsClient.Enqueue(analytics.Track{
+		_ = analyticsClient.Enqueue(analytics.Track{
 			UserId: username,
 			Event:  "Ran Command",
 			Properties: analytics.NewProperties().
@@ -67,7 +67,7 @@ func write(cmd *cobra.Command, args []string) error {
 			}
 			value = strings.TrimSuffix(v, "\n")
 		} else {
-			v, err := ioutil.ReadAll(os.Stdin)
+			v, err := io.ReadAll(os.Stdin)
 			if err != nil {
 				return err
 			}
diff --git a/environ/environ.go b/environ/environ.go
index 019a6b1..a482ad9 100644
--- a/environ/environ.go
+++ b/environ/environ.go
@@ -89,12 +89,9 @@ func (e *Environ) load(ctx context.Context, s store.Store, service string, colli
 	if err != nil {
 		return err
 	}
-	envVarKeys := make([]string, 0)
 	for _, rawSecret := range rawSecrets {
 		envVarKey := secretKeyToEnvVarName(rawSecret.Key)
 
-		envVarKeys = append(envVarKeys, envVarKey)
-
 		if e.IsSet(envVarKey) {
 			*collisions = append(*collisions, envVarKey)
 		}
diff --git a/store/backendbenchmarks_test.go b/store/backendbenchmarks_test.go
index c0ed1ab..bf115b8 100644
--- a/store/backendbenchmarks_test.go
+++ b/store/backendbenchmarks_test.go
@@ -8,6 +8,8 @@ import (
 	"sync"
 	"testing"
 	"time"
+
+	"github.com/stretchr/testify/require"
 )
 
 // This file contains some tests which can be used to benchmark
@@ -49,11 +51,13 @@ func benchmarkStore(t *testing.T, store Store, services []string) {
 
 		for i := 0; i < concurrency; i++ {
 			wg.Add(1)
-			go emulateExec(t, ctx, &wg, store, services)
-
+			go func() {
+				// TODO: collect errors in a channel
+				_ = emulateExec(t, ctx, &wg, store, services)
+			}()
 		}
 		wg.Wait()
-		elapsed := time.Now().Sub(start)
+		elapsed := time.Since(start)
 		t.Logf("Concurrently started %d services in %s", concurrency, elapsed)
 	}
 }
@@ -106,7 +110,7 @@ func setupStore(t *testing.T, ctx context.Context, store Store, services []strin
 				Key:     key,
 			}
 
-			store.Write(ctx, id, RandStringRunes(100))
+			require.NoError(t, store.Write(ctx, id, RandStringRunes(100)))
 		}
 	}
 }
@@ -120,7 +124,7 @@ func cleanupStore(t *testing.T, ctx context.Context, store Store, services []str
 				Key:     key,
 			}
 
-			store.Delete(ctx, id)
+			require.NoError(t, store.Delete(ctx, id))
 		}
 	}
 }
diff --git a/store/s3store.go b/store/s3store.go
index 2890159..df03664 100644
--- a/store/s3store.go
+++ b/store/s3store.go
@@ -6,7 +6,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"sort"
 	"time"
 
@@ -258,9 +258,7 @@ func (s *S3Store) Delete(ctx context.Context, id SecretId) error {
 		return err
 	}
 
-	if _, ok := index.Latest[id.Key]; ok {
-		delete(index.Latest, id.Key)
-	}
+	delete(index.Latest, id.Key)
 
 	if err := s.deleteObjectById(ctx, id); err != nil {
 		return err
@@ -317,7 +315,7 @@ func (s *S3Store) readObject(ctx context.Context, path string) (secretObject, bo
 		return secretObject{}, false, err
 	}
 
-	raw, err := ioutil.ReadAll(resp.Body)
+	raw, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return secretObject{}, false, err
 	}
@@ -366,7 +364,7 @@ func (s *S3Store) readLatest(ctx context.Context, service string) (latest, error
 		return latest{}, err
 	}
 
-	raw, err := ioutil.ReadAll(resp.Body)
+	raw, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return latest{}, err
 	}
@@ -390,15 +388,6 @@ func (s *S3Store) writeLatest(ctx context.Context, service string, index latest)
 	return s.puts3raw(ctx, path, raw)
 }
 
-func stringInSlice(val string, sl []string) bool {
-	for _, v := range sl {
-		if v == val {
-			return true
-		}
-	}
-	return false
-}
-
 func getObjectPath(id SecretId) string {
 	return fmt.Sprintf("%s/%s.json", id.Service, id.Key)
 }
diff --git a/store/s3storeKMS.go b/store/s3storeKMS.go
index 37de53a..d29c383 100644
--- a/store/s3storeKMS.go
+++ b/store/s3storeKMS.go
@@ -6,7 +6,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"strings"
 	"time"
 
@@ -215,9 +215,7 @@ func (s *S3KMSStore) Delete(ctx context.Context, id SecretId) error {
 		return fmt.Errorf("Unable to overwrite secret %s using new KMS key %s; mismatch with existing key %s", id.Key, s.kmsKeyAlias, val.KMSAlias)
 	}
 
-	if _, ok := index.Latest[id.Key]; ok {
-		delete(index.Latest, id.Key)
-	}
+	delete(index.Latest, id.Key)
 
 	if err := s.deleteObjectById(ctx, id); err != nil {
 		return err
@@ -226,41 +224,6 @@ func (s *S3KMSStore) Delete(ctx context.Context, id SecretId) error {
 	return s.writeLatest(ctx, id.Service, index)
 }
 
-func (s *S3KMSStore) readObject(ctx context.Context, path string) (secretObject, bool, error) {
-	getObjectInput := &s3.GetObjectInput{
-		Bucket: aws.String(s.bucket),
-		Key:    aws.String(path),
-	}
-
-	resp, err := s.svc.GetObject(ctx, getObjectInput)
-	if err != nil {
-		// handle specific AWS  errors
-		var nsb *types.NoSuchBucket
-		if errors.As(err, &nsb) {
-			return secretObject{}, false, err
-		}
-		var nsk *types.NoSuchKey
-		if errors.As(err, &nsk) {
-			return secretObject{}, false, nil
-		}
-		// generic errors
-		return secretObject{}, false, err
-	}
-
-	raw, err := ioutil.ReadAll(resp.Body)
-	if err != nil {
-		return secretObject{}, false, err
-	}
-
-	var obj secretObject
-	if err := json.Unmarshal(raw, &obj); err != nil {
-		return secretObject{}, false, err
-	}
-
-	return obj, true, nil
-
-}
-
 func (s *S3KMSStore) puts3raw(ctx context.Context, path string, contents []byte) error {
 	putObjectInput := &s3.PutObjectInput{
 		Bucket:               aws.String(s.bucket),
@@ -299,7 +262,7 @@ func (s *S3KMSStore) readLatestFile(ctx context.Context, path string) (LatestInd
 		return LatestIndexFile{}, err
 	}
 
-	raw, err := ioutil.ReadAll(resp.Body)
+	raw, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return LatestIndexFile{}, err
 	}
@@ -335,7 +298,7 @@ func (s *S3KMSStore) readLatest(ctx context.Context, service string) (LatestInde
 			result, err := s.readLatestFile(ctx, key_name)
 
 			if err != nil {
-				paginationError = errors.New(fmt.Sprintf("Error reading latest index for KMS Key (%s): %s", key_name, err))
+				paginationError = fmt.Errorf("Error reading latest index for KMS Key (%s): %s", key_name, err)
 				break
 			}
 
diff --git a/store/secretsmanagerstore.go b/store/secretsmanagerstore.go
index b934efa..b0d8784 100644
--- a/store/secretsmanagerstore.go
+++ b/store/secretsmanagerstore.go
@@ -136,9 +136,7 @@ func (s *SecretsManagerStore) Write(ctx context.Context, id SecretId, value stri
 		if err != nil {
 			return err
 		}
-		if _, ok := metadata[id.Key]; ok {
-			delete(metadata, id.Key)
-		}
+		delete(metadata, id.Key)
 
 		rawMetadata, err := dehydrateMetadata(&metadata)
 		if err != nil {
diff --git a/store/secretsmanagerstore_test.go b/store/secretsmanagerstore_test.go
index d37cd3c..ed14e95 100644
--- a/store/secretsmanagerstore_test.go
+++ b/store/secretsmanagerstore_test.go
@@ -5,7 +5,6 @@ import (
 	"crypto/rand"
 	"encoding/json"
 	"fmt"
-	"io"
 	"os"
 	"sort"
 	"testing"
@@ -15,6 +14,7 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/secretsmanager/types"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 type mockSecret struct {
@@ -271,9 +271,9 @@ func TestSecretsManagerRead(t *testing.T) {
 	outputs := make(map[string]secretsmanager.DescribeSecretOutput)
 	store := NewTestSecretsManagerStore(secrets, outputs)
 	secretId := SecretId{Service: "test", Key: "key"}
-	store.Write(ctx, secretId, "value")
-	store.Write(ctx, secretId, "second value")
-	store.Write(ctx, secretId, "third value")
+	require.NoError(t, store.Write(ctx, secretId, "value"))
+	require.NoError(t, store.Write(ctx, secretId, "second value"))
+	require.NoError(t, store.Write(ctx, secretId, "third value"))
 
 	t.Run("Reading the latest value should work", func(t *testing.T) {
 		s, err := store.Read(ctx, secretId, -1)
@@ -318,7 +318,7 @@ func TestSecretsManagerList(t *testing.T) {
 		{Service: "test", Key: "c"},
 	}
 	for _, secret := range testSecrets {
-		store.Write(ctx, secret, "value")
+		require.NoError(t, store.Write(ctx, secret, "value"))
 	}
 
 	t.Run("List should return all keys for a service", func(t *testing.T) {
@@ -348,8 +348,8 @@ func TestSecretsManagerList(t *testing.T) {
 	})
 
 	t.Run("List should only return exact matches on service name", func(t *testing.T) {
-		store.Write(ctx, SecretId{Service: "match", Key: "a"}, "val")
-		store.Write(ctx, SecretId{Service: "matchlonger", Key: "a"}, "val")
+		require.NoError(t, store.Write(ctx, SecretId{Service: "match", Key: "a"}, "val"))
+		require.NoError(t, store.Write(ctx, SecretId{Service: "matchlonger", Key: "a"}, "val"))
 
 		s, err := store.List(ctx, "match", false)
 		assert.Nil(t, err)
@@ -370,7 +370,7 @@ func TestSecretsManagerListRaw(t *testing.T) {
 		{Service: "test", Key: "c"},
 	}
 	for _, secret := range testSecrets {
-		store.Write(ctx, secret, "value")
+		require.NoError(t, store.Write(ctx, secret, "value"))
 	}
 
 	t.Run("ListRaw should return all keys and values for a service", func(t *testing.T) {
@@ -389,8 +389,8 @@ func TestSecretsManagerListRaw(t *testing.T) {
 	})
 
 	t.Run("List should only return exact matches on service name", func(t *testing.T) {
-		store.Write(ctx, SecretId{Service: "match", Key: "a"}, "val")
-		store.Write(ctx, SecretId{Service: "matchlonger", Key: "a"}, "val")
+		require.NoError(t, store.Write(ctx, SecretId{Service: "match", Key: "a"}, "val"))
+		require.NoError(t, store.Write(ctx, SecretId{Service: "matchlonger", Key: "a"}, "val"))
 
 		s, err := store.ListRaw(ctx, "match")
 		sort.Sort(ByKeyRaw(s))
@@ -415,7 +415,7 @@ func TestSecretsManagerHistory(t *testing.T) {
 	}
 
 	for _, s := range testSecrets {
-		store.Write(ctx, s, "value")
+		require.NoError(t, store.Write(ctx, s, "value"))
 	}
 
 	t.Run("History for a non-existent key should return not found error", func(t *testing.T) {
@@ -447,7 +447,7 @@ func TestSecretsManagerDelete(t *testing.T) {
 	store := NewTestSecretsManagerStore(secrets, outputs)
 
 	secretId := SecretId{Service: "test", Key: "key"}
-	store.Write(ctx, secretId, "value")
+	require.NoError(t, store.Write(ctx, secretId, "value"))
 
 	t.Run("Deleting secret should work", func(t *testing.T) {
 		err := store.Delete(ctx, secretId)
@@ -464,6 +464,6 @@ func TestSecretsManagerDelete(t *testing.T) {
 
 func uniqueID() string {
 	uuid := make([]byte, 16)
-	io.ReadFull(rand.Reader, uuid)
+	_, _ = rand.Read(uuid)
 	return fmt.Sprintf("%x", uuid)
 }
diff --git a/store/shared_test.go b/store/shared_test.go
index 793b940..148fac7 100644
--- a/store/shared_test.go
+++ b/store/shared_test.go
@@ -32,6 +32,7 @@ func TestGetConfig(t *testing.T) {
 	assert.Equal(t, "us-west-2", region)
 
 	endpoint, err := config.EndpointResolverWithOptions.ResolveEndpoint("ssm", "us-west-2")
+	assert.NoError(t, err)
 	assert.Equal(t, "https://example.com/custom-endpoint", endpoint.URL)
 	assert.Equal(t, aws.EndpointSourceCustom, endpoint.Source)
 
diff --git a/store/ssmstore.go b/store/ssmstore.go
index 007fd28..91eebf4 100644
--- a/store/ssmstore.go
+++ b/store/ssmstore.go
@@ -26,10 +26,6 @@ const (
 // when using paths
 var validPathKeyFormat = regexp.MustCompile(`^(\/[\w\-\.]+)+$`)
 
-// validKeyFormat is the format that is expected for key names inside parameter store when
-// not using paths
-var validKeyFormat = regexp.MustCompile(`^[\w\-\.]+$`)
-
 // ensure SSMStore confirms to Store interface
 var _ Store = &SSMStore{}
 
@@ -206,14 +202,13 @@ func (s *SSMStore) readLatest(ctx context.Context, id SecretId) (Secret, error)
 	}
 	param := resp.Parameters[0]
 	var parameter *types.ParameterMetadata
-	var describeParametersInput *ssm.DescribeParametersInput
 
 	// To get metadata, we need to use describe parameters
 
 	// There is no way to use describe parameters to get a single key
 	// if that key uses paths, so instead get all the keys for a path,
 	// then find the one you are looking for :(
-	describeParametersInput = &ssm.DescribeParametersInput{
+	describeParametersInput := &ssm.DescribeParametersInput{
 		ParameterFilters: []types.ParameterStringFilter{
 			{
 				Key:    aws.String("Path"),
@@ -250,9 +245,8 @@ func (s *SSMStore) readLatest(ctx context.Context, id SecretId) (Secret, error)
 
 func (s *SSMStore) ListServices(ctx context.Context, service string, includeSecretName bool) ([]string, error) {
 	secrets := map[string]Secret{}
-	var describeParametersInput *ssm.DescribeParametersInput
 
-	describeParametersInput = &ssm.DescribeParametersInput{
+	describeParametersInput := &ssm.DescribeParametersInput{
 		MaxResults: aws.Int32(50),
 		ParameterFilters: []types.ParameterStringFilter{
 			{
diff --git a/store/ssmstore_test.go b/store/ssmstore_test.go
index 0b0bae1..fbb6140 100644
--- a/store/ssmstore_test.go
+++ b/store/ssmstore_test.go
@@ -13,6 +13,7 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/ssm"
 	"github.com/aws/aws-sdk-go-v2/service/ssm/types"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 type mockParameter struct {
@@ -356,7 +357,7 @@ func TestListRawWithPaths(t *testing.T) {
 		{Service: "test", Key: "c"},
 	}
 	for _, secret := range secrets {
-		store.Write(ctx, secret, "value")
+		require.NoError(t, store.Write(ctx, secret, "value"))
 	}
 
 	t.Run("ListRaw should return all keys and values for a service", func(t *testing.T) {
@@ -374,8 +375,8 @@ func TestListRawWithPaths(t *testing.T) {
 	})
 
 	t.Run("List should only return exact matches on service name", func(t *testing.T) {
-		store.Write(ctx, SecretId{Service: "match", Key: "a"}, "val")
-		store.Write(ctx, SecretId{Service: "matchlonger", Key: "a"}, "val")
+		require.NoError(t, store.Write(ctx, SecretId{Service: "match", Key: "a"}, "val"))
+		require.NoError(t, store.Write(ctx, SecretId{Service: "matchlonger", Key: "a"}, "val"))
 
 		s, err := store.ListRaw(ctx, "match")
 		assert.Nil(t, err)
@@ -418,9 +419,9 @@ func TestReadPaths(t *testing.T) {
 	parameters := map[string]mockParameter{}
 	store := NewTestSSMStore(parameters)
 	secretId := SecretId{Service: "test", Key: "key"}
-	store.Write(ctx, secretId, "value")
-	store.Write(ctx, secretId, "second value")
-	store.Write(ctx, secretId, "third value")
+	require.NoError(t, store.Write(ctx, secretId, "value"))
+	require.NoError(t, store.Write(ctx, secretId, "second value"))
+	require.NoError(t, store.Write(ctx, secretId, "third value"))
 
 	t.Run("Reading the latest value should work", func(t *testing.T) {
 		s, err := store.Read(ctx, secretId, -1)
@@ -464,7 +465,7 @@ func TestListPaths(t *testing.T) {
 		{Service: "test", Key: "c"},
 	}
 	for _, secret := range secrets {
-		store.Write(ctx, secret, "value")
+		require.NoError(t, store.Write(ctx, secret, "value"))
 	}
 
 	t.Run("List should return all keys for a service", func(t *testing.T) {
@@ -494,8 +495,8 @@ func TestListPaths(t *testing.T) {
 	})
 
 	t.Run("List should only return exact matches on service name", func(t *testing.T) {
-		store.Write(ctx, SecretId{Service: "match", Key: "a"}, "val")
-		store.Write(ctx, SecretId{Service: "matchlonger", Key: "a"}, "val")
+		require.NoError(t, store.Write(ctx, SecretId{Service: "match", Key: "a"}, "val"))
+		require.NoError(t, store.Write(ctx, SecretId{Service: "matchlonger", Key: "a"}, "val"))
 
 		s, err := store.List(ctx, "match", false)
 		assert.Nil(t, err)
@@ -517,7 +518,7 @@ func TestHistoryPaths(t *testing.T) {
 	}
 
 	for _, s := range secrets {
-		store.Write(ctx, s, "value")
+		require.NoError(t, store.Write(ctx, s, "value"))
 	}
 
 	t.Run("History for a non-existent key should return not found error", func(t *testing.T) {
@@ -548,7 +549,7 @@ func TestDeletePaths(t *testing.T) {
 	store := NewTestSSMStore(parameters)
 
 	secretId := SecretId{Service: "test", Key: "key"}
-	store.Write(ctx, secretId, "value")
+	require.NoError(t, store.Write(ctx, secretId, "value"))
 
 	t.Run("Deleting secret should work", func(t *testing.T) {
 		err := store.Delete(ctx, secretId)