Get value from parameter store via code pipeline output '***'

user_5616407 0
Viewed 1054

Base on AWS Code Build documentation, we can pass EnvironmentVariables with PARAMETER_STORE type.

I've ensure the parameter store name is typed correctly and the parameter is exists.

I've tried to login via aws cli but it seem not related and still get wrong result.

Here is my cloudformation yaml snippet:

- Name: Build
  Actions:
    - Name: HelloWord
      ActionTypeId:
        Category: Build
        Owner: AWS
        Provider: CodeBuild
        Version: "1"
      Configuration:
        ProjectName: HelloWoldBuild
        EnvironmentVariables: 
          Fn::Sub:
            - '[{"name": "NGINX_BASE_IMAGE_TAG","value": "${NGINX_BASE_IMAGE_TAG}","type": "PARAMETER_STORE"}]
            - NGINX_BASE_IMAGE_TAG: "/nginx/base"

and here is my buildspec.yaml snippet:

version: 0.2

phases:
  install:
    runtime-versions:
      docker: 18
  pre_build:
    commands:
      - echo "${NGINX_BASE_IMAGE_TAG}"

When I see the CodeBuild log, the output was '***'. The correct one should be value from my parameter store.

How could it happen ? I still don't get it. I've test with PLAINTEXT type and works well.

aws-codebuild amazon-web-services environment-variables
1 Answers

This is by design.

Values from parameter store are considers as sensitive.

So CodeBuild masks them so they don't appear in plain text in its logs.

To deal with that, you can assign it to different variable, and print that. The following would be my first try to deal with that:

  pre_build:
    commands:
      - NEW_VAR=${NGINX_BASE_IMAGE_TAG}
      - echo "${NEW_VAR}"

Alternative. Save it to file and print out a file:

  pre_build:
    commands:
      - echo ${NGINX_BASE_IMAGE_TAG} > /tmp/test.value
      - cat /tmp/test.value
user_2488230
Related