ssmtree

Render AWS SSM Parameter Store as a colorized terminal tree. Browse, diff, and copy parameters across namespaces.

Features

• Tree view — Visualize SSM parameters as a rich, colorized tree in your terminal
• Diff — Compare parameters between two namespaces side by side
• Copy — Copy parameters from one namespace to another with dry-run support
• Glob filtering — Filter parameters with glob patterns to focus on what matters
• JSON output — Export parameter trees or diffs as JSON for scripting and automation
• Decrypt support — Decrypt SecureString parameters inline with optional KMS key re-encryption
• SecureString safety — SecureString values shown as [redacted] by default; use --decrypt to reveal them
• Leaf parameter support — Query a single leaf parameter directly (e.g. ssmtree /app/db/password)

Installation

pip install ssmtree

For development:

git clone https://github.com/Specter099/ssmtree.git
cd ssmtree
python -m venv .venv
source .venv/bin/activate
pip install -e ".[dev]"

Quick Start

# Browse all parameters under a prefix
ssmtree /app/prod

# Query a single leaf parameter
ssmtree /app/prod/db/password

# Decrypt SecureString values (shown as [redacted] by default)
ssmtree --decrypt /app/prod

# Hide all values entirely
ssmtree --hide-values /app/prod

# Filter with a glob pattern
ssmtree --filter "*db*" /app

# JSON output (SecureStrings redacted by default)
ssmtree --output json /app/prod

# JSON output with SecureString values included
ssmtree --decrypt --output json --include-secrets /app/prod

Commands

diff

Compare parameters between two namespaces:

# Table diff (default)
ssmtree diff /app/prod /app/staging

# With decryption
ssmtree diff --decrypt /app/prod /app/staging

# JSON diff output
ssmtree diff --output json /app/prod /app/staging

# JSON diff with SecureString values included
ssmtree diff --decrypt --output json --include-secrets /app/prod /app/staging

copy

Copy parameters from one namespace to another:

# Preview what would be copied
ssmtree copy --dry-run /app/prod /app/staging

# Copy (prompts for confirmation)
ssmtree copy /app/prod /app/staging

# Copy with overwrite, skip confirmation
ssmtree copy --yes --overwrite /app/prod /app/staging

# Copying SecureStrings requires --decrypt (see "Secret handling" below)
ssmtree copy --decrypt /app/prod /app/staging

# Copy with decryption and re-encryption under a new KMS key
ssmtree copy --decrypt --kms-key-id alias/my-key /app/prod /app/staging

Note: copy refuses to copy SecureString parameters unless --decrypt is given. Without it, the source value is still-encrypted KMS ciphertext, and writing that back would silently corrupt the destination secret.

Options

Secret handling

SecureString values are protected by default and revealed only when you opt in:

• Human-readable output (tree, diff table): SecureStrings show as [redacted] unless you pass --decrypt.
• JSON output (--output json): SecureStrings show as ***REDACTED*** unless you pass --include-secrets (which also prints a warning to stderr).
• copy: requires --decrypt to copy SecureStrings at all, so the real plaintext (not KMS ciphertext) is written to the destination.

A SecureString diff without --decrypt always shows as changed because KMS ciphertext is non-deterministic; decrypt to compare real values.

Development

pytest          # run tests
ruff check .    # lint

License

MIT — see LICENSE