SSM Parameter Store Template

Command line application to render templates with data from SSM Parameter Store

Installation

The ssm-ps-template application is available via the Python Package Index and can be installed with pip:

pip install ssm-ps-template

Templating

The application uses Jinja2 for the templating engine. All functionality available to Jinja2 templates by default are exposed in the application.

Using Prefixes

The application has a default prefix of / that is prepended to parameter names that do not start with a leading slash (/).

This functionality allows you to group your variables under a path prefix like /my-application/settings and then only refer to the individual key values like password instead of referencing the full path of /my-application/settings/password.

If you reference a parameter name with a leading slash it will not prepend the prefix to the parameter name.

Getting Parameter Store Values

The application exposes get_parameter(name: str, default: typing.Optional[str] = None) in templates to access the values in SSM Parameter Store.

In the following example we assume there are Parameter Store values for the keys /my-application/foo and /my-application/bar and that the application is called with a prefix of /my-appliction:

foo: {{ get_parameter('/my-application/foo') }}
bar: {{ get_parameter('/my-application/bar') }}

Will render as:

foo: bar
baz: qux

Additionally, there is another function exposed get_parameters_by_path(path: str, default: typing.Optional[dict] = None) which will return a dictionary for the specified path.

The following example will iterate over the results:

{% for key, value in get_parameters_by_path('settings/', {}).items() %}
  {{ key }}: {{ value }}
{% endfor %}

Or you can use Jinja filters to convert them to YAML:

{{ get_parameters_by_path('settings/') | path_to_dict | toyaml | indent(2, first=True) }}

For values in ParameterStore that are stored as StringList, they are automatically transformed as a list of strings. Given the following value:

And the following template:

Connections:
{% for connection in get_parameter('/my-application/connections', []) %}
  - {{ connection }}

The following would be rendered:

Connections:
  - amqp://server1
  - amqp://server2

Performance Considerations

The parameter names are gathered in a pre-processing step to minimize calls to SSM Parameter Store.

Configuration

The configuration file provides the ability to specify multiple templates, override AWS configuration, and change logging levels:

Top-Level Configuration Directives

Template Configuration Directives

The templates directive in the configuration is an array of objects:

If there are parent directories in the destination path that do not exist, they will be created.

Extended Templating Functionality

In addition to the base functionality exposed by Jinja2, the following Python functions have been added:

The following filters are added:

The following variables are exposed:

Configuration File Format

The application supports JSON, TOML, or YAML for configuration. The following example is in YAML:

Example Configuration File

templates:
  - source: /etc/ssm-templates/nginx-example
    destination: /etc/nginx/sites-available/example
    prefix: /namespaced/application/nginx/
  - source: /etc/ssm-templates/postgres-example
    destination: /etc/postgresql/14/main/postgresql.conf
    prefix: /namespaced/application/postgres/
    user: postgres
    group: postgres
    mode: 0600
profile: default
region: us-east-1
verbose: false

Command Line Usage

usage: ssm-ps-template [-h] [--aws-profile AWS_PROFILE] [--aws-region AWS_REGION] [--endpoint-url ENDPOINT_URL] [--prefix PREFIX] [--replace-underscores]
                       [--verbose] [--version]
                       config

Command line application to render templates with data from SSM Parameter Store

positional arguments:
  config

optional arguments:
  -h, --help            show this help message and exit
  --aws-profile AWS_PROFILE
                        AWS Profile (default: None)
  --aws-region AWS_REGION
                        AWS Region (default: None)
  --endpoint-url ENDPOINT_URL
                        Specify an endpoint URL to use when contacting SSM Parameter Store. (default: None)
  --prefix PREFIX       Default SSM Key Prefix (default: /)
  --replace-underscores
                        Replace underscores in variable names to dashes when looking for values in SSM (default: False)
  --verbose
  --version             show program's version number and exit

Note that the default SSM prefix can also be set with the PARAMS_PREFIX environment variable and the endpoint URL setting cn be set with the SSM_ENDPOINT_URL environment variable.