1

I need to lookup a value from AWS SSM Parameter Store, but it needs to fail if the parameter type is secure string.

I do NOT want secure string parameters to be decrypted, and I want to detect their type and fail gracefully.

  - name: Get the value from AWS Parameter Store
    set_fact:
      var_value: "{{ lookup('aws_ssm', var_path, decrypt=False, region=aws_region, aws_access_key=aws_access_key, aws_secret_key=aws_secret_key) }}"

- name: Show the value
  debug: 
    msg:
      - "VALUE:  {{ var_value | default( 'FAILED_TO_DECRYPT' ) }}"

However, the aws_ssm module does not fail when told not to decrypt a secure string. It returns the encrypted string (not helpful). I don't see a way to detect parameter type.

TASK [Show the value] **********************************************************
ok: [127.0.0.1] => {
    "msg": [
        "VALUE:  CRAZY_LONG_ENCRYPTED_STRING_AND_NOT_THE_REAL_VALUE"
    ]
}

What is a best practice for intentionally failing to decrypt secure strings?

References:

  1. https://docs.ansible.com/ansible/latest/collections/amazon/aws/aws_ssm_lookup.html
  2. https://docs.ansible.com/ansible/latest/collections/community/aws/aws_ssm_parameter_store_module.html
2
  • 1
    As a side note, you should not nest moustaches. {{ lookup('aws_ssm', '{{ var_path }}') }} should instead be {{ lookup('aws_ssm', var_path) }}. Once you are in a Jinja expression you do not need additional delimiters. Dec 28, 2021 at 21:20
  • @flowerysong Thanks! Dec 29, 2021 at 13:59

1 Answer 1

1

One way is to get the value twice, with decrypt=false and decrypt=true, and compare them.

- name: Get the value from AWS Parameter Store
  set_fact:
    var_value_decrypted: "{{ lookup('aws_ssm', var_path, decrypt=true, region=aws_region, aws_access_key=aws_access_key, aws_secret_key=aws_secret_key) }}"
    var_value_as_is: "{{ lookup('aws_ssm', var_path, decrypt=false, region=aws_region, aws_access_key=aws_access_key, aws_secret_key=aws_secret_key) }}"

- name: Fail since the value is encrypted and permission_to_decrypt is false
  debug: 
    msg:
      - "VALUE:  FAILED_TO_DECRYPT"
  when: var_value_decrypted != var_value_as_is and not permission_to_decrypt | bool

- name: Show the value
  debug: 
    msg:
      - "VALUE:  {{ var_value_decrypted | default( 'KEY_NOT_FOUND' ) }}"
  when: var_value_decrypted == var_value_as_is or permission_to_decrypt | bool

If they are different and permission_to_decrypt is false, fail with an error

"VALUE:  FAILED_TO_DECRYPT"

If they are the same or permission_to_decrypt is true, show the value

"VALUE:  super secret string"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.