cdk-secure-string-parameter/lib/secure-string-parameter.d.ts

SecureStringParameter Custom Resource for CDK. Enables storing encrypted secrets in version control and using those values in creating SSM SecureString Parameters

import { ITaggable, RemovalPolicy, Resource, TagManager } from 'aws-cdk-lib';
import { Grant, IGrantable } from 'aws-cdk-lib/aws-iam';
import { IKey } from 'aws-cdk-lib/aws-kms';
import { IStringParameter, ParameterDataType, ParameterOptions, ParameterType } from 'aws-cdk-lib/aws-ssm';
import { Construct } from 'constructs';
/**
 * The type of the stringValue.
 */
export declare enum ValueType {
    /**
     * Indicates that the value of this parameter is encrypted with a kms key.
     */
    ENCRYPTED = "encrypted",
    /**
     * Indicates that the value of this parameter is in plain text.
     */
    PLAINTEXT = "plaintext"
}
export type CamelCase<T> = {
    [K in keyof T as Uncapitalize<K & string>]: T[K];
};
interface BaseProps extends ParameterOptions {
    /**
     * The value of the parameter. It may not reference another parameter and ``{{}}`` cannot be used in the value.
     */
    readonly stringValue: string;
    /**
     * The data type of the parameter value. Only `text` is allowed.
     * @default ParameterDataType.TEXT
     */
    readonly dataType?: ParameterDataType.TEXT;
    /**
     * The type of the parameter. Only `SecureString` is allowed.
     * @default ParameterType.SECURE_STRING
     */
    readonly type?: ParameterType.SECURE_STRING;
    /**
     * Policy to apply when the parameter is removed from this stack.
     * @default RemovalPolicy.DESTROY
     */
    readonly removalPolicy?: RemovalPolicy;
}
export interface EncryptedSecureStringParameterProps extends BaseProps {
    /**
     * The encryption key that is used to encrypt this parameter.
     * */
    readonly encryptionKey: IKey;
    /**
     * The type of the stringValue. Use type `encrypted` if the value is encrypted with a kms key.
     *
     * **WARNING:** If you use `plaintext`, the unecrypted value of the parameter is visible to anyone who has access to cloudformation or deploy artifacts.
     */
    readonly valueType: ValueType.ENCRYPTED;
}
export interface PlainTextSecureStringParameterProps extends BaseProps {
    /**
     * The encryption key that is used to encrypt this parameter.
     * @default alias/aws/ssm
     * */
    readonly encryptionKey?: IKey;
    /**
     * The type of the stringValue. Use type `encrypted` if the value is encrypted with a kms key.
     *
     * **WARNING:** If you use `plaintext`, the unecrypted value of the parameter is visible to anyone who has access to cloudformation or deploy artifacts.
     */
    readonly valueType: ValueType.PLAINTEXT;
}
export type SecureStringParameterProps = EncryptedSecureStringParameterProps | PlainTextSecureStringParameterProps;
/**
 * Creates a new SecureString SSM Parameter.
 *
 * If the valueType property is set to `encrypted`, the actual SSM SecureString Parameter will be created with a decrypted value from the stringValue property.
 * @resource Custom::SecureStringParameter
 */
export declare class SecureStringParameter extends Resource implements IStringParameter, ITaggable {
    private readonly eventHandler;
    private readonly provider;
    private stringParameter?;
    readonly tags: TagManager;
    /**
     * The encryption key that is used to encrypt this parameter.
     *
     * @attribute
     */
    readonly encryptionKey?: IKey;
    readonly parameterArn: string;
    readonly parameterName: string;
    readonly parameterType: string;
    readonly stringValue: string;
    /**
     * The type of the stringValue.
     */
    readonly valueType: ValueType;
    constructor(scope: Construct, id: string, props: SecureStringParameterProps);
    grantRead(grantee: IGrantable): Grant;
    grantWrite(grantee: IGrantable): Grant;
    /**
     * Returns this parameter as a native StringParameter.
     */
    asStringParameter(): IStringParameter;
    private getOrCreateHandler;
    private getOrCreateProvider;
}
export {};