ssm-sync

Env Variables

Running in cluster

Name	Description
AWS_REGION	required, the region we are replicating from.
SSM_PATH	required, this specifies the source ssm path, ex: "/my-ssm-path/".
HOSTNAME	required, used in IRSA session name.

Local testing

Name	Description
LOCAL	if set run using a local aws profile for testing.
AWS_PROFILE	name of the aws profile to use when running locally.

Parameter tags

Source parameter

Parameters must have a ssm-replicate-regions tag or they are ignored. The tag value for ssm-replicate-regions is a : separated list of region to replicate the parameter to.

Example:

ssm-replicate-regions: us-east-1:us-west-1

Destination parameter

Replicated parameters get tagged with ssm-replicated-from. The value of these tags is the source region the parameter was replicated from.

If the destination parameter exists it must be tagged with ssm-replicated-from and the tag value must match AWS_REGION or it will be skipped.

Required Permissions

Below is a sample AWS policy that shows the required permissions for syncing parameters:

{
   "Statement": [
       {
           "Action": [
               "ssm:GetParametersByPath",
               "ssm:GetParameter",
               "ssm:PutParameter",
               "ssm:GetParameters",
               "ssm:ListTagsForResource",
               "ssm:AddTagsToResource"
           ],
           "Effect": "Allow",
           "Resource": "arn:aws:ssm:*:<account number>:parameter/*",
           "Sid": "SSMSync"
       }
   ],
   "Version": "2012-10-17"
}

larntz/ssm-sync