ssm
This middleware fetches parameters from AWS Systems Manager Parameter Store.
Parameters to fetch can be defined by path and by name (not mutually exclusive). See AWS docs here.
Parameters can be assigned to the function handler's context
object by setting the setToContext
flag to true
. By default all parameters are added with uppercase names.
The Middleware makes a single API request to fetch all the parameters defined by name, but must make an additional request per specified path. This is because the AWS SDK currently doesn't expose a method to retrieve parameters from multiple paths.
For each parameter defined by name, you also provide the name under which its value should be added to context
. For each path, you instead provide a prefix, and by default the value import each parameter returned from that path will be added to context
with a name equal to what's left of the parameter's full name after the defined path, with the prefix prepended. If the prefix is an empty string, nothing is prepended. You can override this behaviour by providing your own mapping function with the getParamNameFromPath
config option.
Install
To install this middleware you can use NPM:
- npm
- Yarn
npm install --save @middy/ssm
npm install --save-dev @aws-sdk/client-ssm
yarn add @middy/ssm
yarn add --dev @aws-sdk/client-ssm
Options
AwsClient
(object) (defaultSSMClient
): SSMClient class constructor (i.e. that has been instrumented with AWS X-Ray). Must be from@aws-sdk/client-ssm
.awsClientOptions
(object) (optional): Options to pass to SSMClient class constructor.awsClientAssumeRole
(string) (optional): Internal key where role tokens are stored. See @middy/sts on to set this.awsClientCapture
(function) (optional): Enable AWS X-Ray by passingcaptureAWSv3Client
fromaws-xray-sdk
in.fetchData
(object) (required): Mapping of internal key name to API request parameterNames
/Path
.SecureString
are automatically decrypted.disablePrefetch
(boolean) (defaultfalse
): On cold start requests will trigger early if they can. SettingawsClientAssumeRole
disables prefetch.cacheKey
(string) (defaultssm
): Cache key for the fetched data responses. Must be unique across all middleware.cacheExpiry
(number) (default-1
): How long fetch data responses should be cached for.-1
: cache forever,0
: never cache,n
: cache for n ms.setToContext
(boolean) (defaultfalse
): Store role tokens torequest.context
.
NOTES:
- Lambda is required to have IAM permission for
ssm:GetParameters
and/orssm:GetParametersByPath
depending on what you're requesting, along withkms:Decrypt
. SSM
has throughput limitations. Switching to Advanced Parameter type or increasingmaxRetries
andretryDelayOptions.base
inawsClientOptions
may be required.
Sample usage
import middy from '@middy/core'
import ssm from '@middy/ssm'
const handler = middy((event, context) => {
return {}
})
let globalDefaults = {}
handler
.use(
ssm({
fetchData: {
accessToken: '/dev/service_name/access_token', // single value
dbParams: '/dev/service_name/database/', // object of values, key for each path
defaults: '/dev/defaults'
},
setToContext: true
})
)
.before((request) => {
globalDefaults = request.context.defaults.global
})
import middy from '@middy/core'
import { getInternal } from '@middy/util'
import ssm from '@middy/ssm'
const handler = middy((event, context) => {
return {}
})
let globalDefaults = {}
handler
.use(
ssm({
fetchData: {
defaults: '/dev/defaults'
},
cacheKey: 'ssm-defaults'
})
)
.use(
ssm({
fetchData: {
accessToken: '/dev/service_name/access_token', // single value
dbParams: '/dev/service_name/database/' // object of values, key for each path
},
cacheExpiry: 15 * 60 * 1000,
cacheKey: 'ssm-secrets'
})
)
// ... other middleware that fetch
.before(async (request) => {
const data = await getInternal(
['accessToken', 'dbParams', 'defaults'],
request
)
Object.assign(request.context, data)
})
Bundling
To exclude @aws-sdk
add @aws-sdk/client-ssm
to the exclude list.