/parameter-store-executor

Tool to execute things with ENV vars set from AWS Parameter Store variables

Primary LanguageRustThe UnlicenseUnlicense

Parameter Store Executor

Fetches parameters recursively from AWS SSM Parameter Store at the given PARAMETER_PATH(s). Then executes PROGRAM with the parameters supplied as ENV variables.

Before passing the parameters to the PROGRAM, their names will be transformed as follows:

  • Remove PARAMETER_PATH prefix
  • Replace the symbols . (period), - (hyphen) and / (forward slash) with _ (underscore)
  • Made UPPERCASE

Conflicting parameters will resolve to the value of the last one found. Any existing ENV variables (unless --clean-env is specified) will be passed along and takes precedence over parameters with the same name - to allow overriding specific parameters (e.g in development environment).

Given the following parameters:
| name           | value  |
+----------------+--------+
| /one/user-name | user-1 |
| /one/password  | pass-1 |
| /two/user-name | user-2 |
| /two/password  | pass-2 |

And the following existing ENV vars
| name         | value    |
+--------------+----------+
| TWO_PASSWORD | from-env |

When requesting: [/, /one, /two]

Then the following ENV variables will be available:
| name          | value    | comment                  |
+---------------+----------+--------------------------+
| ONE_USER_NAME | user-1   | /                        |
| ONE_PASSWORD  | pass-1   | /                        |
| TWO_USER_NAME | user-2   | /                        |
| TWO_PASSWORD  | from-env | /, superceded by ENV var |
| USER_NAME     | user-2   | /one, superceded by /two |
| PASSWORD      | pass-2   | /one, superceded by /two |

Installation

Build and install from source

  1. Clone the repo
  2. Run cargo install --path .

Released binary

Download the desired version from the releases page.

Usage

When started, the tool will try to detect your current AWS credentials in the following order:

  1. From ENV variables
  2. From ~/.aws/credentials
  3. From the instance metadata service (useful on EC2 instances)

Basic command line usage

pse /path/to/parameters -- env

Use the --help option for further information on how to invoke the tool.

With Docker

Install the binary release from GitHub

FROM alpine

# install a specific binary release
ARG pse_version=latest
ADD https://github.com/neochrome/parameter-store-executor/releases/download/${pse_version}/pse-linux-amd64 /pse
# -- or --
# use the latest released version
ADD https://github.com/neochrome/parameter-store-executor/releases/latest/download/pse-linux-adm64 /pse

# make the binary executable
RUN chmod +x /pse

Install the binary release from Docker Hub

The binary release is additionally pushed to Docker Hub and may be installed using a COPY --from statement like so:

# install a specific binary release
COPY --from=neochrome/parameter-store-executor:0.2.0 /pse /
# -- or --
# use the latest version
COPY --from=neochrome/parameter-store-executor:latest /pse /

# make the binary executable
RUN chmod +x /pse

Entrypoint

The tool may be specified as the ENTRYPOINT of a docker image to allow for easy use of AWS SSM Parameter Store parameters with your application:

FROM alpine

# install the binary release using one of the methods above

# specify AWS_REGION unless passed from outside your container
ENV AWS_REGION=eu-west-1

# use an ENV var to specify the parameter(s) to use
ENV PARAMETER_PATH=/some/path
ENTRYPOINT /pse "$PARAMETER_PATH" -- env
# -- or --
# specify the parameter(s) directly in the ENTRYPOINT
# and optionally use CMD
ENTRYPOINT [ "/pse", "/some/path", "--" ]
CMD ["env"]

Launching the container

When launching the container you need to pass the set of credentials to be used either as ENV variables or by mounting the credentials as a volume.

Passing credentials as ENV vars

Using the docker commandline:

docker run -e AWS_ACCESS_KEYID -e AWS_SECRET_ACCESS_KEY your_image

Using docker-compose:

version: '3'
services:
  app:
    image: your_image
    environment:
      - AWS_ACCESS_KEYID
      - AWS_SECRET_ACCESS_KEY

Mounting ~./aws/credentials

Using the docker commandline:

docker run -v $HOME/.aws/credentials:/root/.aws/credentials:ro your_image

Using docker-compose:

version: '3'
services:
  app:
    image: your_image
    volumes:
      - $HOME/.aws/credentials:/root/.aws/credentials:ro

Contributing

  1. Fork it (https://github.com/neochrome/parameter-store-executor/fork)
  2. Create your feature branch (git checkout -b my-new-feature)
  3. Commit your changes (git commit -am 'feat: some new feature'), make sure to use https://www.conventionalcommits.org/.
  4. Push to the branch (git push origin my-new-feature)
  5. Create a new Pull Request

Releasing

Releases are automated using Release Please.