29 ms·

> If you need something more advanced than Cloudformation to define your infrastructure as code, try Troposphere or CDK The author has already hit a use-case t

> If you need something more advanced than Cloudformation to define your infrastructure as code, try Troposphere or CDK The author has already hit a use-case that is not currently supported by Cloud formation (creating a SecureString SSM parameter)--that's something that Troposphere or the CDK won't help you with (unless you use them to create the resource via the API rather than Cloud formation).

scarface74 8y ago
He was willing to use external Terraform modules why not a CF custom resource? A quick Google search found this: https://svdgraaf.nl/2018/04/13/CloudFormation-ssm-secure-string-support-boto3-custom-resource.html https://svdgraaf.nl/2018/04/13/CloudFormation-ssm-secure-str...
- Varriount 8y ago
  Pre-built custom resources (like the one linked) are under not all that common. The fact that there's one that exists for this particular situation I would ascribe more to luck, then a generous amount of public material.
  - scarface74 8y ago
    Not being able to create a secure string parameter was the first problem I ran into with CloudFormation. That’s how I happened to know that a custom resource for it existed. But, creating a custom resource is relatively easy. I’ve had to create a few for things that are really “custom” to our environment. I used these as templates —- https://github.com/stelligent/cloudformation-custom-resources https://github.com/stelligent/cloudformation-custom-resource... One issue that really seemed like an oversight is that you can’t add a event subscription to an existing S3 bucket. I had to write a custom resource to do it.
    - tie_ 8y ago
      > Not being able to create a secure string parameter was the first problem I ran into with CloudFormation. How about 'NoEcho' type of CFN parameters?
      - scarface74 8y ago
        What do you mean?
        tie_ 8y ago
        CloudFormation supports the "NoEcho" option specifically to allow password-type parameters, which are not inspectable. How is that not a secure string parameter?
        scarface74 7y ago
        I realize this response is late. The term “parameters” is unfortunately overloaded. CloudFormation parameters are used within CF. We were referring to parameters in Parameter Store. https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-paramstore.html https://docs.aws.amazon.com/systems-manager/latest/userguide... But then, how do you get the secret value from CF to parameter store? If you put the value of the parameter in your template, then it is stored unencrypted in your template that is probably in source control. For that, I use a combination of NoEcho in CF and use that user entered value as a !Ref when creating the parameter store. Run the template manually one time and then you can have it default to the existing value. But you need a custom resource to create a secure string type.
- robrtsql 8y ago
  Yep, that's what I use as well. It works, but I don't really love that I have to create an IAM role and a Lambda function just to create an encrypted secret.
tie_ 8y ago
Actually, if the author had used CloudFormation, they could have a password-type (NoEcho) Input, and then they wouldn't need to deal with SSM at all. Much less hassle, and just as (in)secure. To do it properly, the author could have created an AWS KMS key, encrypted the password with that key, and then stored the encrypted password in source control. Then password goes in as a regular, plain-text parameter, and the container decrypts it thanks to having the proper IAM permissions for the AWS Key. It's slightly more complicated but you get 1) ability to store the (encrypted) password in source control and 2) the ability to let anyone work with the stack without giving them the plaintext pw. If you do want to stick to SSM for whatever reason, you can also use SSM parameters as Inputs to CloudFormation, so you can use a custom resource OR an out-of-band process to set the password up. It's wouldn't be great, but it's not the right tool for the job in the first place.

scarface74 8y ago

He was willing to use external Terraform modules why not a CF custom resource? A quick Google search found this: https://svdgraaf.nl/2018/04/13/CloudFormation-ssm-secure-string-support-boto3-custom-resource.html https://svdgraaf.nl/2018/04/13/CloudFormation-ssm-secure-str...

Varriount 8y ago
Pre-built custom resources (like the one linked) are under not all that common. The fact that there's one that exists for this particular situation I would ascribe more to luck, then a generous amount of public material.
- scarface74 8y ago
  Not being able to create a secure string parameter was the first problem I ran into with CloudFormation. That’s how I happened to know that a custom resource for it existed. But, creating a custom resource is relatively easy. I’ve had to create a few for things that are really “custom” to our environment. I used these as templates —- https://github.com/stelligent/cloudformation-custom-resources https://github.com/stelligent/cloudformation-custom-resource... One issue that really seemed like an oversight is that you can’t add a event subscription to an existing S3 bucket. I had to write a custom resource to do it.
  - tie_ 8y ago
    > Not being able to create a secure string parameter was the first problem I ran into with CloudFormation. How about 'NoEcho' type of CFN parameters?
    - scarface74 8y ago
      What do you mean?
      - tie_ 8y ago
        CloudFormation supports the "NoEcho" option specifically to allow password-type parameters, which are not inspectable. How is that not a secure string parameter?
        scarface74 7y ago
        I realize this response is late. The term “parameters” is unfortunately overloaded. CloudFormation parameters are used within CF. We were referring to parameters in Parameter Store. https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-paramstore.html https://docs.aws.amazon.com/systems-manager/latest/userguide... But then, how do you get the secret value from CF to parameter store? If you put the value of the parameter in your template, then it is stored unencrypted in your template that is probably in source control. For that, I use a combination of NoEcho in CF and use that user entered value as a !Ref when creating the parameter store. Run the template manually one time and then you can have it default to the existing value. But you need a custom resource to create a secure string type.
robrtsql 8y ago
Yep, that's what I use as well. It works, but I don't really love that I have to create an IAM role and a Lambda function just to create an encrypted secret.

tie_ 8y ago

Actually, if the author had used CloudFormation, they could have a password-type (NoEcho) Input, and then they wouldn't need to deal with SSM at all. Much less hassle, and just as (in)secure. To do it properly, the author could have created an AWS KMS key, encrypted the password with that key, and then stored the encrypted password in source control. Then password goes in as a regular, plain-text parameter, and the container decrypts it thanks to having the proper IAM permissions for the AWS Key. It's slightly more complicated but you get 1) ability to store the (encrypted) password in source control and 2) the ability to let anyone work with the stack without giving them the plaintext pw. If you do want to stick to SSM for whatever reason, you can also use SSM parameters as Inputs to CloudFormation, so you can use a custom resource OR an out-of-band process to set the password up. It's wouldn't be great, but it's not the right tool for the job in the first place.