How to create a Parameter Store entry without a value in AWS CDK?

Viewed 1324

In AWS CDK, you can create a parameter store entry for storing secrets like passwords.

However you cannot leave the value blank, and you shouldn't put the secret in the CDK git repository, so how do you get the entry created?

I am currently doing something like this:

const paramKey = new cdkSSM.StringParameter(this, 'example-key', {
    description: 'Example SSH private key parameter',
    parameterName: 'example-key',
    stringValue: `???`, /// What goes here?
    allowedPattern: '^-----BEGIN RSA PRIVATE KEY-----[^-]*-----END RSA PRIVATE KEY-----$',
});

In this case, I can't leave the stringValue blank or I get an error, as Parameter Store does not allow blank values. The only value it will accept is an RSA private key, due to the allowedPattern requirement (which is a safety measure to stop someone from accidentally putting in an invalid value through the AWS CLI). But I don't want to put my private key in as it should not be part of the CDK git repository. I don't want to use a dummy key as then someone might think the correct key has been entered already.

How can I deploy a blank Parameter Store value while having the allowedPattern present?

The only workaround I have come up with is to hack the value to allow another token as well, like this:

const paramKey = new cdkSSM.StringParameter(this, 'example-key', {
    description: 'Example SSH private key parameter',
    parameterName: 'example-key',
    stringValue: `TODO`,
    allowedPattern: '^TODO$|^-----BEGIN RSA PRIVATE KEY-----[^-]*-----END RSA PRIVATE KEY-----$',
});

This means the Parameter Store entry will accept either an RSA key or the value TODO. But this seems very hacky so I am wondering whether there is a proper solution for this?

0 Answers
Related