How to hide terraform aws_ssm_parameter values

user_11020763 0
Viewed 1382

I have an SSM parameter created with type SecureString and key-value as (pasword=Passwor@d123). I am trying to fetch the value using data resources where the value is getting printed in plan output.

data "aws_ssm_parameter" "foo" {
 name = "password"
}

module "lamda_env_vars" {
New_password = data.aws_ssm_parameter.foo.value
}

plan output:-

New_paswword = Password@123

I tried encryption like below.

data "aws_ssm_parameter" "foo" {
 name = "password"
with_decryption = false
}

module "lambda_env_vars" {
New_password = data.aws_ssm_parameter.foo.value
}

plan output:-
New_password = Q#iuws##)9ssdhs(some encryptrd value)

Here the problem is the same encrypted hash code is getting assigned as the value for my lambda function.

How to mask value while terraforming plan and get the plain text value for my lambda function?

aws-ssm terraform-provider-aws terraform amazon-web-services
1 Answers

Generally you would just pass the name of the SSM's SecretString parameter as an env variable to your lambda function. Then the lambda function would fetch it itself from the SSM Parameter Store.

If you want to use approach with with_decryption = false, then your lambda function will have to call KMS decrypt API to actually decrypt the ciphered text into its plain text version.

In both cases the execution role of your function would need to have permissions to KMS and/or SSM Parameter Store.

user_2488230
Related