aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

Support for retrieving SSM SecureString values as Parameters

Open
#1,665 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::SSM::Parameter

### Resource name

AWS::SSM::Parameter::Value

### Description

I am trying to configure an ELB for auth via OIDC. To do this, I have to pass in a shared secret as a property, namely as part of `AWS::ElasticLoadBalancingV2::Listener/Properties/DefaultActions`.

My customer is currently not allowing use of Secrets Manager. They do allow SSM Parameter Store with SecureString types, but I'm unable to retrieve the _value_ of a SecureString at build-time, as I would by doing:

```
Parameters:
SomeString:
Type: AWS::SSM::Parameter::Value
```

(as per [the docs](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/parameters-section-structure.html#aws-ssm-parameter-types))

I'm unable to use the [dynamic approach](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/dynamic-references.html#dynamic-references-ssm-secure-strings) because that approach only supports 11 resources for SSM Secure Strings...

Why is retrieving the value of a SecureString not supported? If it's for security reasons, please allow customers to make that choice and if so use `NoEcho` to mitigate some risk.

As it stands, there is no way to pass a secret in to CF for use within the template except via Secrets Manager, which removes all choice from customers.

### Other Details

Refs:

* https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/parameters-section-structure.html#aws-ssm-parameter-types
* https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/dynamic-references.html#dynamic-references-ssm-secure-strings
* https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/parameters-section-structure.html#parameters-section-structure-properties

Contributor guide

Open the contributing guide

Research direction

Review the AWS CloudFormation parameter-type and dynamic-reference documentation linked in the issue, starting with AWS::SSM::Parameter::Value. Define the supported retrieval behavior and security constraints; done when CloudFormation can expose SecureString values for uses such as ELB listener actions, or documents why this remains unsupported.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.