Using the New AWS Secrets Manager for Serverless

Re:Using the New AWS Secrets Manager for Serverless by scarface74 on Tuesday January 08, 2019 @09:49PM (#18861868)

I’ve been bitten by it doing something as simple as creating parameters using CloudFormation. The only way around it is judicious use of DependsOn to make them single threaded.

[ Parent | on HN ]

Re:Using the New AWS Secrets Manager for Serverless by Cpoll on Wednesday January 09, 2019 @08:06PM (#18870651)

Thanks for this, I was considering bringing params into CF, the main blocker being that it doesn't support secure params (which is obvious in retrospect, they wouldn't be secure in the template).

[ Parent | on HN ]

Re:Using the New AWS Secrets Manager for Serverless by scarface74 on Wednesday January 09, 2019 @08:45PM (#18870830)

For secure strings in cloud formation, I use a cloud formation parameter ( - meaning I have to enter the parameter manually and set NoEcho to true. And then set the CF parameter value to the SSM Parameter value.

This is with the help of a lambda backed custom resource

https://svdgraaf.nl/2018/04/13/CloudFormation-ssm-secure-str...

Obviously , this can’t be a part of your CI/CD Pipeline. I run the CloudFormation template manually in the console to enter the parameters and my CI Pipeline can then update the stack when needed.

[ Parent | on HN ]