ssm: deploy-time random string generator for Parameter store
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 71
Description
### Describe the feature
This is a feature request for Systems Manager Parameter store construct [`StringParameter`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ssm.StringParameter.html) to generate a random string on deploy-time.
Secrets Manager construct ([`Secret`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_secretsmanager.Secret.html)) already has this feature and it is useful for generating secrets such as a database password. However, the drawback of Secret Manager is its cost; it costs [$0.40/month per secret](https://aws.amazon.com/secrets-manager/pricing/). Parameter store is a lot cheaper; it incurrs [no additional charge](https://aws.amazon.com/systems-manager/pricing/) for storing a parameter.
If we can reliably and deterministically generate a cryptographically-secure random string for a parameter store, it will be a handy way to store secrets.
### Use Case
Generate and store an API key or encryption key for an app deployed by CDK.
### Proposed Solution
To avoid from any breaking changes, we add a new construct e.g. `GeneratedStringParameter`
Generally speaking, each parameter is used to store a single parameter, not an object like JSON, so we only need a simpler API than Secrets Manager. Something like the below should suffice:
```ts
new GeneratedStringParameter(scope, 'id', {
parameterName: 'foo',
generateOption: {
excludeCharacters: 'asdf',
excludeLowercase: true,
excludeNumbers: true,
excludePunctuation: true,
excludeUppercase: true,
includeSpace: false,
length: 46,
requireEachIncludedType: true
}
});
```
The `generateOption` follows the existing [`SecretStringGenerator`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_secretsmanager.SecretStringGenerator.html#generatestringkey) except the template feature, which should meet most use cases.
Besides that, the construct should inherit all the props from [`StringParameterProps`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ssm.StringParameterProps.html) except `stringValue`, which will be filled by a random generated string.
Inside the construct, we add a custom resource to generate a string and a StringParameter construct:
```ts
class GeneratedStringParameter {
constructor(scope, id, props) {
const generator = new CustomResource(this, 'Generator', {
serviceToken:...,
resourceType: 'Custom:RandomStringGenerator',
properties: {...props.generateOption},
});
new StringParameter(this, 'Resource', {
...props,
stringValue: generator.getAttString('generated'),
});
}
}
```
### Other Information
_No response_
### Acknowledgements
- [X] I may be able to implement this feature request
- [ ] This feature might incur a breaking change
### CDK version used
2.149.0
### Environment details (OS name and version, etc.)
macOS
Contributor guide
Research direction
Start by comparing the existing StringParameter and Secret/SecretStringGenerator constructs and their documented properties. Resolve the proposed GeneratedStringParameter API and custom-resource design, then verify that the construct can create and retain a deploy-time generated Parameter Store value with the requested generation options.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100