cdk-secure-string-parameter/lib/lambda/secure-string-parameter-handler.lambda.js

SecureStringParameter Custom Resource for CDK. Enables storing encrypted secrets in version control and using those values in creating SSM SecureString Parameters

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.handler = handler;
const client_kms_1 = require("@aws-sdk/client-kms");
const client_ssm_1 = require("@aws-sdk/client-ssm");
const kms = new client_kms_1.KMSClient({ region: process.env.AWS_REGION });
const ssm = new client_ssm_1.SSMClient({ region: process.env.AWS_REGION });
function handler(event) {
    console.debug(JSON.stringify(event));
    switch (event.RequestType) {
        case 'Create':
            return onCreateAndUpdate(event);
        case 'Update':
            return onCreateAndUpdate(event);
        case 'Delete':
            return onDelete(event);
        default:
            throw new Error(`Unknown RequestType: ${event.RequestType}`);
    }
}
async function onCreateAndUpdate(event) {
    const { AllowedPattern, Description, Name, Tags, Tier, EncryptionKey, Value, ValueType } = event.ResourceProperties;
    const decryptedValue = ValueType === 'encrypted' ? await decrypt(Value, EncryptionKey) : Value;
    await ssm.send(new client_ssm_1.PutParameterCommand({
        AllowedPattern,
        Description,
        Name,
        KeyId: EncryptionKey,
        Overwrite: true,
        Tier,
        Type: 'SecureString',
        Value: decryptedValue,
    }));
    await updateTags(Name, Tags);
    return {
        PhysicalResourceId: Name,
    };
}
async function onDelete(event) {
    const { Name } = event.ResourceProperties;
    await ssm.send(new client_ssm_1.DeleteParameterCommand({
        Name,
    }));
    return {
        PhysicalResourceId: Name,
    };
}
async function decrypt(value, key) {
    const params = {
        CiphertextBlob: Buffer.from(value, 'base64'),
        KeyId: key, // AWS can infer the key from value if no key is given, but this function requires permissions to decrypt
    };
    const { Plaintext } = await kms.send(new client_kms_1.DecryptCommand(params));
    if (Plaintext === undefined)
        throw new Error('Unable to decrypt');
    return Buffer.from(Plaintext).toString('utf-8');
}
async function updateTags(parameterName, tags) {
    const { TagList } = await ssm.send(new client_ssm_1.ListTagsForResourceCommand({
        ResourceType: 'Parameter',
        ResourceId: parameterName,
    }));
    const removableTags = TagList?.reduce((list, tag) => {
        if (tag.Key && !Object.keys(tags || {}).includes(tag.Key)) {
            list.push(tag.Key);
        }
        return list;
    }, []);
    if (removableTags?.length) {
        await ssm.send(new client_ssm_1.RemoveTagsFromResourceCommand({
            ResourceType: 'Parameter',
            ResourceId: parameterName,
            TagKeys: removableTags,
        }));
    }
    if (tags) {
        await ssm.send(new client_ssm_1.AddTagsToResourceCommand({
            ResourceType: 'Parameter',
            ResourceId: parameterName,
            Tags: Object.entries(tags).map(([key, value]) => {
                return { Key: key, Value: value };
            }),
        }));
    }
}
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VjdXJlLXN0cmluZy1wYXJhbWV0ZXItaGFuZGxlci5sYW1iZGEuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvbGFtYmRhL3NlY3VyZS1zdHJpbmctcGFyYW1ldGVyLWhhbmRsZXIubGFtYmRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBMEJBLDBCQVlDO0FBdENELG9EQUFxRjtBQUNyRixvREFBaU07QUFzQmpNLE1BQU0sR0FBRyxHQUFHLElBQUksc0JBQVMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLFVBQVUsRUFBRSxDQUFDLENBQUM7QUFDOUQsTUFBTSxHQUFHLEdBQUcsSUFBSSxzQkFBUyxDQUFDLEVBQUUsTUFBTSxFQUFFLE9BQU8sQ0FBQyxHQUFHLENBQUMsVUFBVSxFQUFFLENBQUMsQ0FBQztBQUU5RCxTQUFnQixPQUFPLENBQUMsS0FBc0M7SUFDNUQsT0FBTyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDckMsUUFBUSxLQUFLLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDMUIsS0FBSyxRQUFRO1lBQ1gsT0FBTyxpQkFBaUIsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNsQyxLQUFLLFFBQVE7WUFDWCxPQUFPLGlCQUFpQixDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ2xDLEtBQUssUUFBUTtZQUNYLE9BQU8sUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3pCO1lBQ0UsTUFBTSxJQUFJLEtBQUssQ0FBQyx3QkFBd0IsS0FBSyxDQUFDLFdBQVcsRUFBRSxDQUFDLENBQUM7SUFDakUsQ0FBQztBQUNILENBQUM7QUFFRCxLQUFLLFVBQVUsaUJBQWlCLENBQUMsS0FBc0M7SUFDckUsTUFBTSxFQUFFLGNBQWMsRUFBRSxXQUFXLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsYUFBYSxFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsR0FBRyxLQUFLLENBQUMsa0JBQWtCLENBQUM7SUFDcEgsTUFBTSxjQUFjLEdBQUcsU0FBUyxLQUFLLFdBQVcsQ0FBQyxDQUFDLENBQUMsTUFBTSxPQUFPLENBQUMsS0FBSyxFQUFFLGFBQWEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUM7SUFDL0YsTUFBTSxHQUFHLENBQUMsSUFBSSxDQUFDLElBQUksZ0NBQW1CLENBQUM7UUFDckMsY0FBYztRQUNkLFdBQVc7UUFDWCxJQUFJO1FBQ0osS0FBSyxFQUFFLGFBQWE7UUFDcEIsU0FBUyxFQUFFLElBQUk7UUFDZixJQUFJO1FBQ0osSUFBSSxFQUFFLGNBQWM7UUFDcEIsS0FBSyxFQUFFLGNBQWM7S0FDdEIsQ0FBQyxDQUFDLENBQUM7SUFDSixNQUFNLFVBQVUsQ0FBQyxJQUFJLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDN0IsT0FBTztRQUNMLGtCQUFrQixFQUFFLElBQUk7S0FDekIsQ0FBQztBQUNKLENBQUM7QUFFRCxLQUFLLFVBQVUsUUFBUSxDQUFDLEtBQXNDO0lBQzVELE1BQU0sRUFBRSxJQUFJLEVBQUUsR0FBRyxLQUFLLENBQUMsa0JBQWtCLENBQUM7SUFDMUMsTUFBTSxHQUFHLENBQUMsSUFBSSxDQUFDLElBQUksbUNBQXNCLENBQUM7UUFDeEMsSUFBSTtLQUNMLENBQUMsQ0FBQyxDQUFDO0lBQ0osT0FBTztRQUNMLGtCQUFrQixFQUFFLElBQUk7S0FDekIsQ0FBQztBQUNKLENBQUM7QUFFRCxLQUFLLFVBQVUsT0FBTyxDQUFDLEtBQWEsRUFBRSxHQUF1QjtJQUMzRCxNQUFNLE1BQU0sR0FBd0I7UUFDbEMsY0FBYyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLFFBQVEsQ0FBQztRQUM1QyxLQUFLLEVBQUUsR0FBRyxFQUFFLHlHQUF5RztLQUN0SCxDQUFDO0lBQ0YsTUFBTSxFQUFFLFNBQVMsRUFBRSxHQUFHLE1BQU0sR0FBRyxDQUFDLElBQUksQ0FBQyxJQUFJLDJCQUFjLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUNqRSxJQUFJLFNBQVMsS0FBSyxTQUFTO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDO0lBQ2xFLE9BQU8sTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUM7QUFDbEQsQ0FBQztBQUVELEtBQUssVUFBVSxVQUFVLENBQUMsYUFBcUIsRUFBRSxJQUF3QztJQUN2RixNQUFNLEVBQUUsT0FBTyxFQUFFLEdBQUcsTUFBTSxHQUFHLENBQUMsSUFBSSxDQUFDLElBQUksdUNBQTBCLENBQUM7UUFDaEUsWUFBWSxFQUFFLFdBQVc7UUFDekIsVUFBVSxFQUFFLGFBQWE7S0FDMUIsQ0FBQyxDQUFDLENBQUM7SUFDSixNQUFNLGFBQWEsR0FBRyxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUMsSUFBSSxFQUFFLEdBQUcsRUFBRSxFQUFFO1FBQ2xELElBQUksR0FBRyxDQUFDLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxJQUFJLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUMxRCxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUNyQixDQUFDO1FBQ0QsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDLEVBQUUsRUFBYyxDQUFDLENBQUM7SUFDbkIsSUFBSSxhQUFhLEVBQUUsTUFBTSxFQUFFLENBQUM7UUFDMUIsTUFBTSxHQUFHLENBQUMsSUFBSSxDQUFDLElBQUksMENBQTZCLENBQUM7WUFDL0MsWUFBWSxFQUFFLFdBQVc7WUFDekIsVUFBVSxFQUFFLGFBQWE7WUFDekIsT0FBTyxFQUFFLGFBQWE7U0FDdkIsQ0FBQyxDQUFDLENBQUM7SUFDTixDQUFDO0lBQ0QsSUFBSSxJQUFJLEVBQUUsQ0FBQztRQUNULE1BQU0sR0FBRyxDQUFDLElBQUksQ0FBQyxJQUFJLHFDQUF3QixDQUFDO1lBQzFDLFlBQVksRUFBRSxXQUFXO1lBQ3pCLFVBQVUsRUFBRSxhQUFhO1lBQ3pCLElBQUksRUFBRSxNQUFNLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxFQUFFLEVBQUU7Z0JBQzlDLE9BQU8sRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsQ0FBQztZQUNwQyxDQUFDLENBQUM7U0FDSCxDQUFDLENBQUMsQ0FBQztJQUNOLENBQUM7QUFDSCxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgS01TQ2xpZW50LCBEZWNyeXB0Q29tbWFuZCwgRGVjcnlwdENvbW1hbmRJbnB1dCB9IGZyb20gJ0Bhd3Mtc2RrL2NsaWVudC1rbXMnO1xuaW1wb3J0IHsgU1NNQ2xpZW50LCBQdXRQYXJhbWV0ZXJDb21tYW5kLCBEZWxldGVQYXJhbWV0ZXJDb21tYW5kLCBMaXN0VGFnc0ZvclJlc291cmNlQ29tbWFuZCwgUmVtb3ZlVGFnc0Zyb21SZXNvdXJjZUNvbW1hbmQsIEFkZFRhZ3NUb1Jlc291cmNlQ29tbWFuZCwgUGFyYW1ldGVyVGllciB9IGZyb20gJ0Bhd3Mtc2RrL2NsaWVudC1zc20nO1xuaW1wb3J0IHR5cGUgeyBDbG91ZEZvcm1hdGlvbkN1c3RvbVJlc291cmNlRXZlbnQgfSBmcm9tICdhd3MtbGFtYmRhJztcblxuZXhwb3J0IGludGVyZmFjZSBTZWN1cmVTdHJpbmdQYXJhbWV0ZXJSZXNvdXJjZVByb3BlcnRpZXMge1xuICByZWFkb25seSBBbGxvd2VkUGF0dGVybj86IHN0cmluZztcbiAgcmVhZG9ubHkgRGVzY3JpcHRpb24/OiBzdHJpbmc7XG4gIHJlYWRvbmx5IEVuY3J5cHRpb25LZXk/OiBzdHJpbmc7XG4gIHJlYWRvbmx5IE5hbWU6IHN0cmluZztcbiAgcmVhZG9ubHkgVGFncz86IFJlY29yZDxzdHJpbmcsIHN0cmluZz47XG4gIHJlYWRvbmx5IFRpZXI/OiBQYXJhbWV0ZXJUaWVyO1xuICByZWFkb25seSBWYWx1ZTogc3RyaW5nO1xuICByZWFkb25seSBWYWx1ZVR5cGU6IHN0cmluZztcbn1cblxuZXhwb3J0IHR5cGUgU2VjdXJlU3RyaW5nQ3VzdG9tUmVzb3VyY2VFdmVudCA9IE9taXQ8Q2xvdWRGb3JtYXRpb25DdXN0b21SZXNvdXJjZUV2ZW50LCAnUmVzb3VyY2VQcm9wZXJ0aWVzJz4gJiB7XG4gIFJlc291cmNlUHJvcGVydGllczogU2VjdXJlU3RyaW5nUGFyYW1ldGVyUmVzb3VyY2VQcm9wZXJ0aWVzO1xufTtcblxuZXhwb3J0IGludGVyZmFjZSBDdXN0b21SZXNvdXJjZVJlc3BvbnNlIHtcbiAgUGh5c2ljYWxSZXNvdXJjZUlkOiBzdHJpbmc7XG59XG5cbmNvbnN0IGttcyA9IG5ldyBLTVNDbGllbnQoeyByZWdpb246IHByb2Nlc3MuZW52LkFXU19SRUdJT04gfSk7XG5jb25zdCBzc20gPSBuZXcgU1NNQ2xpZW50KHsgcmVnaW9uOiBwcm9jZXNzLmVudi5BV1NfUkVHSU9OIH0pO1xuXG5leHBvcnQgZnVuY3Rpb24gaGFuZGxlcihldmVudDogU2VjdXJlU3RyaW5nQ3VzdG9tUmVzb3VyY2VFdmVudCk6IFByb21pc2U8Q3VzdG9tUmVzb3VyY2VSZXNwb25zZT4ge1xuICBjb25zb2xlLmRlYnVnKEpTT04uc3RyaW5naWZ5KGV2ZW50KSk7XG4gIHN3aXRjaCAoZXZlbnQuUmVxdWVzdFR5cGUpIHtcbiAgICBjYXNlICdDcmVhdGUnOlxuICAgICAgcmV0dXJuIG9uQ3JlYXRlQW5kVXBkYXRlKGV2ZW50KTtcbiAgICBjYXNlICdVcGRhdGUnOlxuICAgICAgcmV0dXJuIG9uQ3JlYXRlQW5kVXBkYXRlKGV2ZW50KTtcbiAgICBjYXNlICdEZWxldGUnOlxuICAgICAgcmV0dXJuIG9uRGVsZXRlKGV2ZW50KTtcbiAgICBkZWZhdWx0OlxuICAgICAgdGhyb3cgbmV3IEVycm9yKGBVbmtub3duIFJlcXVlc3RUeXBlOiAke2V2ZW50LlJlcXVlc3RUeXBlfWApO1xuICB9XG59XG5cbmFzeW5jIGZ1bmN0aW9uIG9uQ3JlYXRlQW5kVXBkYXRlKGV2ZW50OiBTZWN1cmVTdHJpbmdDdXN0b21SZXNvdXJjZUV2ZW50KTogUHJvbWlzZTxDdXN0b21SZXNvdXJjZVJlc3BvbnNlPiB7XG4gIGNvbnN0IHsgQWxsb3dlZFBhdHRlcm4sIERlc2NyaXB0aW9uLCBOYW1lLCBUYWdzLCBUaWVyLCBFbmNyeXB0aW9uS2V5LCBWYWx1ZSwgVmFsdWVUeXBlIH0gPSBldmVudC5SZXNvdXJjZVByb3BlcnRpZXM7XG4gIGNvbnN0IGRlY3J5cHRlZFZhbHVlID0gVmFsdWVUeXBlID09PSAnZW5jcnlwdGVkJyA/IGF3YWl0IGRlY3J5cHQoVmFsdWUsIEVuY3J5cHRpb25LZXkpIDogVmFsdWU7XG4gIGF3YWl0IHNzbS5zZW5kKG5ldyBQdXRQYXJhbWV0ZXJDb21tYW5kKHtcbiAgICBBbGxvd2VkUGF0dGVybixcbiAgICBEZXNjcmlwdGlvbixcbiAgICBOYW1lLFxuICAgIEtleUlkOiBFbmNyeXB0aW9uS2V5LFxuICAgIE92ZXJ3cml0ZTogdHJ1ZSxcbiAgICBUaWVyLFxuICAgIFR5cGU6ICdTZWN1cmVTdHJpbmcnLFxuICAgIFZhbHVlOiBkZWNyeXB0ZWRWYWx1ZSxcbiAgfSkpO1xuICBhd2FpdCB1cGRhdGVUYWdzKE5hbWUsIFRhZ3MpO1xuICByZXR1cm4ge1xuICAgIFBoeXNpY2FsUmVzb3VyY2VJZDogTmFtZSxcbiAgfTtcbn1cblxuYXN5bmMgZnVuY3Rpb24gb25EZWxldGUoZXZlbnQ6IFNlY3VyZVN0cmluZ0N1c3RvbVJlc291cmNlRXZlbnQpOiBQcm9taXNlPEN1c3RvbVJlc291cmNlUmVzcG9uc2U+IHtcbiAgY29uc3QgeyBOYW1lIH0gPSBldmVudC5SZXNvdXJjZVByb3BlcnRpZXM7XG4gIGF3YWl0IHNzbS5zZW5kKG5ldyBEZWxldGVQYXJhbWV0ZXJDb21tYW5kKHtcbiAgICBOYW1lLFxuICB9KSk7XG4gIHJldHVybiB7XG4gICAgUGh5c2ljYWxSZXNvdXJjZUlkOiBOYW1lLFxuICB9O1xufVxuXG5hc3luYyBmdW5jdGlvbiBkZWNyeXB0KHZhbHVlOiBzdHJpbmcsIGtleTogc3RyaW5nIHwgdW5kZWZpbmVkKTogUHJvbWlzZTxzdHJpbmc+IHtcbiAgY29uc3QgcGFyYW1zOiBEZWNyeXB0Q29tbWFuZElucHV0ID0ge1xuICAgIENpcGhlcnRleHRCbG9iOiBCdWZmZXIuZnJvbSh2YWx1ZSwgJ2Jhc2U2NCcpLFxuICAgIEtleUlkOiBrZXksIC8vIEFXUyBjYW4gaW5mZXIgdGhlIGtleSBmcm9tIHZhbHVlIGlmIG5vIGtleSBpcyBnaXZlbiwgYnV0IHRoaXMgZnVuY3Rpb24gcmVxdWlyZXMgcGVybWlzc2lvbnMgdG8gZGVjcnlwdFxuICB9O1xuICBjb25zdCB7IFBsYWludGV4dCB9ID0gYXdhaXQga21zLnNlbmQobmV3IERlY3J5cHRDb21tYW5kKHBhcmFtcykpO1xuICBpZiAoUGxhaW50ZXh0ID09PSB1bmRlZmluZWQpIHRocm93IG5ldyBFcnJvcignVW5hYmxlIHRvIGRlY3J5cHQnKTtcbiAgcmV0dXJuIEJ1ZmZlci5mcm9tKFBsYWludGV4dCkudG9TdHJpbmcoJ3V0Zi04Jyk7XG59XG5cbmFzeW5jIGZ1bmN0aW9uIHVwZGF0ZVRhZ3MocGFyYW1ldGVyTmFtZTogc3RyaW5nLCB0YWdzOiBSZWNvcmQ8c3RyaW5nLCBzdHJpbmc+IHwgdW5kZWZpbmVkKTogUHJvbWlzZTx2b2lkPiB7XG4gIGNvbnN0IHsgVGFnTGlzdCB9ID0gYXdhaXQgc3NtLnNlbmQobmV3IExpc3RUYWdzRm9yUmVzb3VyY2VDb21tYW5kKHtcbiAgICBSZXNvdXJjZVR5cGU6ICdQYXJhbWV0ZXInLFxuICAgIFJlc291cmNlSWQ6IHBhcmFtZXRlck5hbWUsXG4gIH0pKTtcbiAgY29uc3QgcmVtb3ZhYmxlVGFncyA9IFRhZ0xpc3Q/LnJlZHVjZSgobGlzdCwgdGFnKSA9PiB7XG4gICAgaWYgKHRhZy5LZXkgJiYgIU9iamVjdC5rZXlzKHRhZ3MgfHwge30pLmluY2x1ZGVzKHRhZy5LZXkpKSB7XG4gICAgICBsaXN0LnB1c2godGFnLktleSk7XG4gICAgfVxuICAgIHJldHVybiBsaXN0O1xuICB9LCBbXSBhcyBzdHJpbmdbXSk7XG4gIGlmIChyZW1vdmFibGVUYWdzPy5sZW5ndGgpIHtcbiAgICBhd2FpdCBzc20uc2VuZChuZXcgUmVtb3ZlVGFnc0Zyb21SZXNvdXJjZUNvbW1hbmQoe1xuICAgICAgUmVzb3VyY2VUeXBlOiAnUGFyYW1ldGVyJyxcbiAgICAgIFJlc291cmNlSWQ6IHBhcmFtZXRlck5hbWUsXG4gICAgICBUYWdLZXlzOiByZW1vdmFibGVUYWdzLFxuICAgIH0pKTtcbiAgfVxuICBpZiAodGFncykge1xuICAgIGF3YWl0IHNzbS5zZW5kKG5ldyBBZGRUYWdzVG9SZXNvdXJjZUNvbW1hbmQoe1xuICAgICAgUmVzb3VyY2VUeXBlOiAnUGFyYW1ldGVyJyxcbiAgICAgIFJlc291cmNlSWQ6IHBhcmFtZXRlck5hbWUsXG4gICAgICBUYWdzOiBPYmplY3QuZW50cmllcyh0YWdzKS5tYXAoKFtrZXksIHZhbHVlXSkgPT4ge1xuICAgICAgICByZXR1cm4geyBLZXk6IGtleSwgVmFsdWU6IHZhbHVlIH07XG4gICAgICB9KSxcbiAgICB9KSk7XG4gIH1cbn0iXX0=