Package: aws-ssm-secrets-cli
AWS Secrets CLISonarCloud StatusAboutAWS Secrets CLI is a tool to manageSSM Parameter Store(SecureString and String) using KMS to encrypt your information. This tool enables you to store your secrets information without exposing it to your git repository.MotivationWhen you need to manage SSM parameter (SecureString) in multiple AWS Environments you need to create or update manually, becauseCloudFormationdoesn't support SSM parameter type Secure, you can use AWS CLI or boto3 to establish the parameters for you, but you need to read the secrets values from somewhere. You can't store into your git repository.AWS Secrets CLI provides you a Command Line Interface that manages your secrets usingKMS, so you can store the config file into your git repository because your secrets will not expose, only for people that have access to KMS Key.Installpipinstallaws-ssm-secrets-cliRequirementsIt is necessary to create a KMS key before starting to create the parameter using the CLI.You can create this key using AWS CLI, AWS SDK, console, or CloudFormation:Example using CloudFormation:Description:"KMSKeyforSecrest"Resources:Key:Type:AWS::KMS::KeyProperties:KeyPolicy:Statement:-Action:-kms:Create*-kms:Describe*-kms:Enable*-kms:List*-kms:Put*-kms:Update*-kms:Revoke*-kms:Disable*-kms:Get*-kms:Delete*-kms:ScheduleKeyDeletion-kms:CancelKeyDeletion-kms:GenerateDataKey-kms:TagResource-kms:UntagResourceEffect:AllowPrincipal:AWS:!Sub"arn:aws:iam::${AWS::AccountId}:root"Resource:"*"-Action:-kms:Decrypt-kms:Encrypt-kms:ReEncrypt*-kms:GenerateDataKey*Effect:AllowPrincipal:AWS:!Sub"arn:aws:iam::${AWS::AccountId}:root"Resource:"*"Version:"2012-10-17"Description:AWS KMS Key for secretsUpdateReplacePolicy:RetainDeletionPolicy:RetainKeyAlias:Type:AWS::KMS::AliasProperties:AliasName:alias/infra-scripts-secretsTargetKeyId:!GetAttKey.ArnOutputs:KeyArn:Description:KMS Key ArnValue:!GetAttKey.ArnGetting StartedOur fist configFor naming convention, you should give the environment name for the file name (e.g., dev.yaml)kms:arn:KMS_KEY_ARN (String)#Requiredencryption_sdk:"aws_encryption_sdk"parameters:-name:myparameternamevalue:"MySecretValueHere"type:SecureStringsecrets:-name:mysecretnamevalue:"MySecretValueHere"or AWS Secrets manager with objectkms:arn:KMS_KEY_ARN (String)#Requiredencryption_sdk:"aws_encryption_sdk"parameters:-name:myparameternamevalue:"MySecretValueHere"type:SecureStringsecrets:-name:mysecretnamevalue:user:myusernamepassword:mypasswordEncryptTo encrypt the parameter values, you need to use this command:aws-secretsencrypt-edev.yaml--profilemyprofile--regioneu-west-1DecryptTo edit the values, you can decrypt and re-encrypt the parameter values. You need to use this command:aws-secretsdecrypt-edev.yaml--profilemyprofile--regioneu-west-1At this moment, a new file has createddev.yaml.dec. If you want to decrypt in overwrite mode put the--outputoption with the same file name that you are decrypting.aws-secretsdecrypt-edev.yaml--outputdev.yaml--profilemyprofile--regioneu-west-1After your changes you need to re-encrypt, you can do it using this command:aws-secretsencrypt-edev.yaml--profilemyprofile--regioneu-west-1Create parameters into AWS AccountTo deploy the parameter that you created on the last step, you need to execute this command:aws-secretsdeploy-edev.yaml--profilemyaws-profile--regioneu-west-1Now your parameters have been created in AWS Account.Migrate KMS API to AWS Encryption SDKThe AWS Encryption SDK is a client-side encryption library designed to make it easy for everyone to encrypt and decrypt data using industry standards and best practices. It enables you to focus on the core functionality of your application, rather than on how to best encrypt and decrypt your data. The AWS Encryption SDK is provided free of charge under the Apache 2.0 license.Full documentation:https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/introduction.htmlUsing AWS Encryption enables AWS Secrets CLI to encrypt data with more than 4KB.Migration processDecrypt all SSM parameter and Secrets manager:aws-secretsdecrypt-edev.yaml--outputdev.yaml--profilemyprofile--regioneu-west-1Update YAML configuration to add theencryption_sdkwithaws_encryption_sdkvalue.kms:arn:KMS_KEY_ARNencryption_sdk:"aws_encryption_sdk"parameters:-name:myparameternamevalue:"MySecretValueHere"type:SecureStringsecrets:-name:mysecretnamevalue:"MySecretValueHere"Currently, the default value isboto3Re-encrypt the YAML configuration fileaws-secretsencrypt-edev.yaml--profilemyprofile--regioneu-west-1Configuration Schematags:# Global tags, applied to all the resourceskey:'string'# key/value pairkms:arn:'string'# Required, KMS ARNencryption_sdk:'aws_encryption_sdk'|'boto3'parameters:# AWS SSM Parameter Section-name:'string'# Required, Parameter Namedescription:'string'# Optional, Parameter Descriptiontype:'String|SecureString'# Required, Parameter Typevalue:'string'# Required only for Type 'String' or if it is some YAML tag (e.g. !file or !cmd)tier:'Standard|Advanced|Intelligent-Tiering'# Optional, Parameter Tier, default 'Standard'tags:# Optional, Parameter Tags, it is extended with the global tagskey:'string'secrets:# AWS Secrets Manager secrets Section-name:'string'# Required, Secret Namedescription:'string'# Optional, Secret Descriptionvalue:'string'# Required only if it is some YAML tag (e.g. !file or !cmd)tags:# Optional, Secret Tags, it is extended with the global tagskey:'string'secrets_file:'Path'# Optional, Secrets file path, default '<config-filename>.secrets.yaml'Command Line InterfaceCommand options differ depending on the command, and can be found by running:aws-secrets--help
aws-secretsCOMMAND--helpencryptTo encrypt SecureString parameters and secrets values in the environment file.aws-secretsencrypt--env-file[--profile][--region]OptionsOptionDescriptionData TypeRequiredOptionsDefault--env-fileor-eEnvironment file pathStringtrue--profileAWS ProfileStringfalse--regionAWS RegionStringfalsedecryptTo decrypt SecureString parameters and secrets values in the environment file.aws-secretsdecrypt--env-file[--profile][--region]OptionsOptionDescriptionData TypeRequiredOptionsDefault--env-fileor-eEnvironment file pathStringtrue--profileAWS ProfileStringfalse--regionAWS RegionStringfalseset-parameterCreate or modify the SSM parameter in the environment file.aws-secretsset-parameter--env-file--name[--description][--kms][--type][--profile][--region]OptionsOptionDescriptionData TypeRequiredOptionsDefault--env-fileor-eEnvironment file pathStringtrue--nameor-nSSM Parameter NameStringtrue--descriptionor-dSSM Parameter DescriptionStringfalse--typeor-tSSM Parameter TypeStringtrueStringandSecureStringSecureString--kmsor-kKMS Id or ARNStringtrue--profileAWS ProfileStringfalse--regionAWS RegionStringfalseset-secretCreate or modify secrets in the environment file.aws-secretsset-secret--env-file--name[--description][--kms][--profile][--region]OptionsOptionDescriptionData TypeRequiredOptionsDefault--env-fileor-eEnvironment file pathStringtrue--nameor-nSecret NameStringtrue--descriptionor-dSecret DescriptionStringfalse--kmsor-kKMS Id or ARNStringtrue--profileAWS ProfileStringfalse--regionAWS RegionStringfalseview-parameterView the SSM parameter value in the environment file.aws-secretsview-parameter--env-file--name[--profile][--region]OptionsOptionDescriptionData TypeRequiredOptionsDefault--env-fileor-eEnvironment file pathStringtrue--nameor-nSSM Parameter NameStringtrue--profileAWS ProfileStringfalse--regionAWS RegionStringfalsedeployCreate or update SSM parameters and secrets in the AWS Account.aws-secretsdeploy--env-file[--filter-pattern][--dry-run][--confirm][--only-secrets][--only-parameters][--profile][--region]OptionsOptionDescriptionData TypeRequiredOptionsDefault--env-fileor-eEnvironment file pathStringtrue--filter-patternFilter Pattern (e.g/app/db/*/passwordmatch with/app/db/dev/passwordor/app/db/prod/password)Stringfalse--dry-runExecution without apply the changes on the environmentBooleanfalsefalse--confirmConfirm prompt before apply the changesBooleanfalsefalse--only-secretsApply changes just for AWS SecretsBooleanfalsefalse--only-parametersApply changes just for SSM ParametersBooleanfalsefalse--profileAWS ProfileStringfalse--regionAWS RegionStringfalseResolversThis CLI implements resolvers, which can be used to resolve the value of a command output or a CloudFormation output value.!fileThis resolver is designed to load a file content to the SSM Parameter or Secrets Manager Value.Example:---secrets:-name:mysecretvalue:!filemyfile.txt!cf_outputThis resolver can be used inparameters[*].value,secrets[*].valueandkms.arnproperties.Example:kms:arn:!cf_output"mystack.MyOutputKey"parameters:-name:myparameter-nametype:Stringvalue:!cf_output"mystack.MyOutputKey"kms:arn:!cf_output"mystack.MyOutputKey.us-east-1"parameters:-name:myparameter-nametype:Stringvalue:!cf_output"mystack.MyOutputKey.us-east-1"!cmdThis resolver can be used inparameters[*].valueandsecrets[*].valueproperties.Example:kms:arn:"arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"parameters:-name:myparameter-nametype:SecureStringvalue:!cmd'echo"Teste"'providerscfCloudFormation Stack Output resolverUsage${cf:stack-name.output-name}With default values${cf:stack-name.output-name, 'mydefaultvalue'}sessionAWS Credentials Session resolverUsage${session:profile} or ${session:region}With default values${session:profile, 'myprofile'} or ${session:region, 'us-east-1'}awsAWS Provider resolves the AWS CLI--profileand--regionbased on theaws-secretsCLI.Usage${aws:profile} or ${aws:region}With default values${aws:profile, 'myprofile'} or ${aws:region, 'us-east-1'}Example:With the config file:kms:arn:!cf_output"mystack.KeyArn"parameters:-description:My SSM Parametername:/my/ssm/paramtype:SecureStringvalue:!cmd'awss3ls${aws:profile}${aws:region,"eu-west-1"}'When run theaws-secretswith the--profileor--regionaws-secrets-econf.yaml--profilemyprofile--regionus-east-1The AWS CLI command will be execute this command:awss3ls--profilemyprofile--regionus-east-1If--profilenot be speficied in theaws-secretsexecution, like this:aws-secrets-econf.yaml--regionus-east-1The AWS CLI command will be execute this command:awss3ls--regioneu-west-1The--regioncontinue in the command because the resolver has the default value witheu-west-1in the config file.Global TagsYou also can include Tags on a global level:tags:SomeKey:SomeValuekms:arn:"arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"parameters:...secrets:...