cdk-secure-string-parameter
Version:
SecureStringParameter Custom Resource for CDK. Enables storing encrypted secrets in version control and using those values in creating SSM SecureString Parameters
113 lines (111 loc) • 3.91 kB
JavaScript
;
var __defProp = Object.defineProperty;
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
var __getOwnPropNames = Object.getOwnPropertyNames;
var __hasOwnProp = Object.prototype.hasOwnProperty;
var __export = (target, all) => {
for (var name in all)
__defProp(target, name, { get: all[name], enumerable: true });
};
var __copyProps = (to, from, except, desc) => {
if (from && typeof from === "object" || typeof from === "function") {
for (let key of __getOwnPropNames(from))
if (!__hasOwnProp.call(to, key) && key !== except)
__defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
}
return to;
};
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
// src/lambda/secure-string-parameter-handler.lambda.ts
var secure_string_parameter_handler_lambda_exports = {};
__export(secure_string_parameter_handler_lambda_exports, {
handler: () => handler
});
module.exports = __toCommonJS(secure_string_parameter_handler_lambda_exports);
var import_client_kms = require("@aws-sdk/client-kms");
var import_client_ssm = require("@aws-sdk/client-ssm");
var kms = new import_client_kms.KMSClient({ region: process.env.AWS_REGION });
var ssm = new import_client_ssm.SSMClient({ region: process.env.AWS_REGION });
function handler(event) {
console.debug(JSON.stringify(event));
switch (event.RequestType) {
case "Create":
return onCreateAndUpdate(event);
case "Update":
return onCreateAndUpdate(event);
case "Delete":
return onDelete(event);
default:
throw new Error(`Unknown RequestType: ${event.RequestType}`);
}
}
async function onCreateAndUpdate(event) {
const { AllowedPattern, Description, Name, Tags, Tier, EncryptionKey, Value, ValueType } = event.ResourceProperties;
const decryptedValue = ValueType === "encrypted" ? await decrypt(Value, EncryptionKey) : Value;
await ssm.send(new import_client_ssm.PutParameterCommand({
AllowedPattern,
Description,
Name,
KeyId: EncryptionKey,
Overwrite: true,
Tier,
Type: "SecureString",
Value: decryptedValue
}));
await updateTags(Name, Tags);
return {
PhysicalResourceId: Name
};
}
async function onDelete(event) {
const { Name } = event.ResourceProperties;
await ssm.send(new import_client_ssm.DeleteParameterCommand({
Name
}));
return {
PhysicalResourceId: Name
};
}
async function decrypt(value, key) {
const params = {
CiphertextBlob: Buffer.from(value, "base64"),
KeyId: key
// AWS can infer the key from value if no key is given, but this function requires permissions to decrypt
};
const { Plaintext } = await kms.send(new import_client_kms.DecryptCommand(params));
if (Plaintext === void 0) throw new Error("Unable to decrypt");
return Buffer.from(Plaintext).toString("utf-8");
}
async function updateTags(parameterName, tags) {
const { TagList } = await ssm.send(new import_client_ssm.ListTagsForResourceCommand({
ResourceType: "Parameter",
ResourceId: parameterName
}));
const removableTags = TagList?.reduce((list, tag) => {
if (tag.Key && !Object.keys(tags || {}).includes(tag.Key)) {
list.push(tag.Key);
}
return list;
}, []);
if (removableTags?.length) {
await ssm.send(new import_client_ssm.RemoveTagsFromResourceCommand({
ResourceType: "Parameter",
ResourceId: parameterName,
TagKeys: removableTags
}));
}
if (tags) {
await ssm.send(new import_client_ssm.AddTagsToResourceCommand({
ResourceType: "Parameter",
ResourceId: parameterName,
Tags: Object.entries(tags).map(([key, value]) => {
return { Key: key, Value: value };
})
}));
}
}
// Annotate the CommonJS export names for ESM import in node:
0 && (module.exports = {
handler
});
//# sourceMappingURL=index.js.map