Package: psyml
psymlThe lifecycle of a yml file.The user will prepare a yml file that looks like this:path:/apps/superman/region:us-east-1kmskey:alias/supermantags:cost_center:team17project:supermanparameters:-name:api_versiondescription:The version of the API endpoint, not a secret.type:Stringvalue:2-name:api_tokendescription:The token used to communicate with the API endpoint, typically a secrettype:SecureStringvalue:5a5468-786448467a59-326436Note here all secrets are in plain text. In order to save this into our codebase, we save the file assuperman.nonprod.yml, login to our AWS account from the commandline, then run:psyml encrypt superman.nonprod.ymlThis will generate a file that looks like this:path:/apps/superman/region:us-west-1kmskey:alias/supermanencrypted_with:arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890abtags:cost_center:team17project:supermanowner:platformparameters:-name:api_versiondescription:The version of the API endpoint, not a secret.type:stringvalue:2-name:api_tokendescription:The token used to communicate with the API endpoint, typically a secrettype:securestringvalue:AQECAHiuImqexTQGWMAtOjKMcH5UIxXuSZ5WSGx3WKO+VsUI3AAAAKIwgZ8GCsqGSIb3DQEHBqCBkTCBjgIBADCBiAyJKoZIhvcNAQcBMB4GCWCGSAFLAwQBLjARBAwT3cwVGtUYHz02irsCARCAW8a4Tp7pL+inl7Je7x1xEr84Q4lN11t3dNFVycpMZALe185DYow4i1GlaJnJnB7g6V1ZaiB+b+Diap/5AuM/K3bjLmcTq0molBnn2TG3r0uj70lP0FSqP+XwQ+8=Note that we have added an extra field namedencrypted_with, which is the current id of the KMS key(alias/psyml) used to encrypt our secrets. Moreover, the type of the parameter is changed into lowercase characters.The maintainance of this yml file should not be too difficult. If we need to add configurations, just add it into the yml file and that's it. If we need to add secrets, add the map into parameters, make sure that the value is in plaintext and the type isSecureString. After that, runpsyml encrypt filename.ymlagain, this time, psyml will ignore all encrypted parameters and just encrypt the new ones using the keyid inencrypted_with. To remove entries, please first remove the relevant entry in parameter store before remove the map in the yml file, not because we have any dependencies, but because it is really easy to forget the cleanup process.Keys used in the processWe devoted a separate section for the use of KMS in this tool, because it indeed could be a bit confusing.To be clear, we have used two set of keys, one(alias/psyml) is only used for local encryption so that our secrets can be securily saved into our codebase. The other KMS key is specified by the user inkmskeyfield in the yml file, and it is used for actual parameter store encryption. So when we runpsyml encrypt, we will encrypt the value usingalias/psyml. When we runpsyml decrypt, we will still be usingalias/psymlto decrypt the values. Inpsyml savehowever, we will first usealias/psymlto decrypt the value in memory, then usekmskeyto do the parameter store upload.The key,alias/psymlis created in each account and we use this key to encrypt all the secrets in the yaml files. This key will not be used for parameter encryption in ssm. We are not going to create one CMK per region because it is not necessary. The default region for this key is Sydney(ap-southeast-2) because we are in Australia, and you can change this behaviour by setting environment variablePSYML_KEY_REGIONto something likeus-east-2. If you don't like our alias, you can set that to something else too, using the environment variablePSYML_KEY_ALIAS.In this tool, when we first runencryptand we don't have thatalias/psymlkey in place, the tool will try to create it for you. Please note that this may fail due to permission issues, and if that's the case, please provision the key and the alias using a more powerful role.A short bio of all available actions.commandline syntax looks like:psyml [action] filename.yml, where action could be one of:encrypt: encrypt a yml file with default kms key(alias/psyml).save: save parameters into parameter store using specified KMS key.nuke: remove all the parameter store entries specified in the yml file.decrypt: decrypt a yml file and write output to stdout.refresh: encrypt a yml file using the currentalias/psyml.export: export all variables bash-like so it can be sourced.diff: compare parameters in parameter store with local version.sync: update parameters in parameter store so it's in sync with yml.Known limitationsSome of the commands(diff/sync) are not implemented yet.parameter store typeStringListis not supported yet.We are using the KMS service and please checkthe KMS pricing pagebefore continue.