aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
Support for retrieving SSM SecureString values as Parameters
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::SSM::Parameter
### Resource name
AWS::SSM::Parameter::Value
### Description
I am trying to configure an ELB for auth via OIDC. To do this, I have to pass in a shared secret as a property, namely as part of `AWS::ElasticLoadBalancingV2::Listener/Properties/DefaultActions`.
My customer is currently not allowing use of Secrets Manager. They do allow SSM Parameter Store with SecureString types, but I'm unable to retrieve the _value_ of a SecureString at build-time, as I would by doing:
```
Parameters:
SomeString:
Type: AWS::SSM::Parameter::Value
```
(as per [the docs](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/parameters-section-structure.html#aws-ssm-parameter-types))
I'm unable to use the [dynamic approach](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/dynamic-references.html#dynamic-references-ssm-secure-strings) because that approach only supports 11 resources for SSM Secure Strings...
Why is retrieving the value of a SecureString not supported? If it's for security reasons, please allow customers to make that choice and if so use `NoEcho` to mitigate some risk.
As it stands, there is no way to pass a secret in to CF for use within the template except via Secrets Manager, which removes all choice from customers.
### Other Details
Refs:
* https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/parameters-section-structure.html#aws-ssm-parameter-types
* https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/dynamic-references.html#dynamic-references-ssm-secure-strings
* https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/parameters-section-structure.html#parameters-section-structure-properties
Contributor guide
Research direction
Review the AWS CloudFormation parameter-type and dynamic-reference documentation linked in the issue, starting with AWS::SSM::Parameter::Value. Define the supported retrieval behavior and security constraints; done when CloudFormation can expose SecureString values for uses such as ELB listener actions, or documents why this remains unsupported.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100