Inject Secrets from Parameter Store

This guide shows you how to pull values from AWS Systems Manager Parameter Store or Secrets Manager into your application, using the ssm dependency engine.

Pulls parameters and secrets from your cloud provider into a Kubernetes secret in
your application's namespace. If you have not created the secret yet, create it
first in Secrets Manager — see
Secrets Manager,
which can generate this configuration for you.

The parameter name in the cloud provider must follow this format, matching your
application's stage, environment, namespace, and instance:

/<stage>/<tenant>/<namespace>/application-secrets-<instance>

For example, a SecureString parameter named
/dev/<your-environment>/payments/application-secrets-gw holding:

{
  "EMAIL_HOST_PASSWORD": "...",
  "SOME_SECRET_KEY": "..."
}

is read by this application configuration:

dependency:
  ssm:
    followKeysFormat: true
    instance: gw
    namespace: payments
    json: "false"
    keys:
      - EMAIL_HOST_PASSWORD
      - SOME_SECRET_KEY

Key	Default	Description
`keys`	`[]`	Parameters to fetch. With `json: "true"` the keys are looked up inside one JSON secret; with `"false"` each key is a separate parameter
`followKeysFormat`	`false`	When `false`, every key in the resulting secret is uppercased
`instance`	application name	Read another instance's parameters
`namespace`	application namespace	Read another namespace's parameters
`secretName`	auto-generated	Name of the created Kubernetes secret — rarely needs setting
`sOverride`	—	Set to `secretsmanager` to read from AWS Secrets Manager instead of Parameter Store
`json`	`"false"`	Whether the stored secret is a JSON object

Worked example — your own secrets plus one shared value

A common case is an application that has its own secrets but also needs a value
that several teams share. Keep the shared value in its own parameter and
override the location for just that key:

dependency:
  ssm:
    keys:
      - EMAIL_HOST_PASSWORD
      - ssmKeys:
          - SHARED_API_KEY
        namespace: "shared"
        instance: "common"
        sOverride: secretsmanager
        json: "true"

The first entry is read from the application's own parameter using the defaults.
The second is read from a JSON secret in AWS Secrets Manager belonging to the
shared namespace and the common instance. Each override applies only to the
entry it sits under, so you do not have to move your own secrets to match.

Application Dependencies — all dependency engines, and how to choose
Attach to Your Application
Secrets Manager
IAM Service Accounts
Access Management

Worked example — your own secrets plus one shared value

Related articles