Hello world, it’s the AWS parameter store
Tags: linux, devops, aws, intermediate
Published: 2021-06-16 14:42:57

---
title: Hello world, it’s the AWS parameter store
description:  "Using a secret in a script"
published: true
date: 2021-05-26 15:00:00 UTC
tags: linux,devops,aws,intermediate
canonical_url: https://katiekodes.com/aws-parameter-store-linux-script/
---

I'd like to help some cloud-newbie sysadmins write automation scripts that reduce the overhead for common tasks and therefore make them more appealing to do frequently _(the whole idea behind "infrastructure as code")_:

1. Making changes that prevent issues with the connection between a production transactional database and its production data warehouse, after spinning up a new nonproduction data warehouse by cloning it from a production server _(involves running thousands of commands involving dozens of passwords)_.
2. Changing a database superuser's password in all the places it needs to be changed so that no integrations break

For a "hello world" project, I decided to write a couple of Linux shell scripts that demonstrate the principle of injecting a secret password into the script at runtime using [AWS Systems Manager Parameter Store](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html) to store the passwords.

## Code

First, through the AWS web console, I created a **SecureString** in Parameter Store with a **name** of `/pizza/flavors/first/` and a **value** of `green pepper`.

Next, I put two shell scripts on a Linux machine that was logged into the AWS CLI tool with permission to manipulate the Parameter Store:

**hellopizza.sh**

```sh
var="I like $1 pizza";
echo "$var"
```

**paramstore.sh**

```sh
thekey="/pizza/flavors/$1";
thetopping=`aws ssm get-parameters --names $thekey --with-decryption --query "Parameters[*].{Value:Value}" --output text --region us-west-2`
./hellopizza.sh "$thetopping"
```

## Tests

### Success

To run my code, I typed:

```sh
./paramstore.sh first
```

And we have a winner!  The output was:

```text
I like green pepper pizza
```

### Errors

Not yet having a key named `second`, I tried this to make sure it would fail:

```sh
./paramstore.sh second
```

Sure enough, it did _(note the double gap between `like` and `pizza`)_:

```text
I like  pizza
```

If I ran `./paramstore.sh first` without proper authentication, I would get one of the following two outputs:

```text
An error occurred (ExpiredTokenException) when calling the GetParameters operation: The security token included in the request is expired
I like  pizza
```

```text
An error occurred (AccessDeniedException) when calling the GetParameters operation: User: MY_AWS_USERNAME is not authorized to perform: ssm:GetParameters on resource: MY_AWS_RESOURCE:parameter/C
I like  pizza
```

## Further thoughts

That was easy.  Too easy.  The "dozens of passwords" like `green pepper` would only be needed by code running on the server during occasional sysadmin maintenance tasks.

I feel like the running machine shouldn't normally have `ssm:GetParameters` access, and that a sysadmin should have to go into AWS and flip it on before running these scripts, then flip it off as they finish.  [What do you think?](https://twitter.com/KatieKodes/status/1397528618608234496)

## Future project

A future project might be to repeat this with [AWS Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html).