aws / aws/aws-cdk

ssm: deploy-time random string generator for Parameter store

Open
#30,881 1 comment 2 reactions 0 assignees View on GitHub
@aws-cdk/aws-ssm effort/medium feature-request p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
1d 19h
Merged PRs (30d)
71

Description

### Describe the feature

This is a feature request for Systems Manager Parameter store construct [`StringParameter`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ssm.StringParameter.html) to generate a random string on deploy-time.

Secrets Manager construct ([`Secret`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_secretsmanager.Secret.html)) already has this feature and it is useful for generating secrets such as a database password. However, the drawback of Secret Manager is its cost; it costs [$0.40/month per secret](https://aws.amazon.com/secrets-manager/pricing/). Parameter store is a lot cheaper; it incurrs [no additional charge](https://aws.amazon.com/systems-manager/pricing/) for storing a parameter.

If we can reliably and deterministically generate a cryptographically-secure random string for a parameter store, it will be a handy way to store secrets.

### Use Case

Generate and store an API key or encryption key for an app deployed by CDK.

### Proposed Solution

To avoid from any breaking changes, we add a new construct e.g. `GeneratedStringParameter`

Generally speaking, each parameter is used to store a single parameter, not an object like JSON, so we only need a simpler API than Secrets Manager. Something like the below should suffice:

```ts
new GeneratedStringParameter(scope, 'id', {
parameterName: 'foo',
generateOption: {
excludeCharacters: 'asdf',
excludeLowercase: true,
excludeNumbers: true,
excludePunctuation: true,
excludeUppercase: true,
includeSpace: false,
length: 46,
requireEachIncludedType: true
}
});
```

The `generateOption` follows the existing [`SecretStringGenerator`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_secretsmanager.SecretStringGenerator.html#generatestringkey) except the template feature, which should meet most use cases. 

Besides that, the construct should inherit all the props from [`StringParameterProps`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ssm.StringParameterProps.html) except `stringValue`, which will be filled by a random generated string.

Inside the construct, we add a custom resource to generate a string and a StringParameter construct:

```ts
class GeneratedStringParameter {
constructor(scope, id, props) {
const generator = new CustomResource(this, 'Generator', {
serviceToken:...,
resourceType: 'Custom:RandomStringGenerator',
properties: {...props.generateOption},
});

new StringParameter(this, 'Resource', {
...props,
stringValue: generator.getAttString('generated'),
});
}
}
```

### Other Information

_No response_

### Acknowledgements

- [X] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.149.0

### Environment details (OS name and version, etc.)

macOS

Contributor guide

Open the contributing guide

Research direction

Start by comparing the existing StringParameter and Secret/SecretStringGenerator constructs and their documented properties. Resolve the proposed GeneratedStringParameter API and custom-resource design, then verify that the construct can create and retain a deploy-time generated Parameter Store value with the requested generation options.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.