
Product
Introducing Socket Firewall: Free, Proactive Protection for Your Software Supply Chain
Socket Firewall is a free tool that blocks malicious packages at install time, giving developers proactive protection against rising supply chain attacks.
@lumigo/serverless-crossaccount-ssm
Advanced tools
Serverless framework plugin to access the system and secrets managers at isolated account
Serverless framework plugin to access the system and secrets managers at isolated account.
Currently only the AWS provider is supported.
NOTE: secrets must be deployed by the lumigo-secure-store
repository and their values set before they can be used.
Run npm install
in your Serverless project.
npm install --save-dev @lumigo/serverless-crossaccount-ssm
If you're using the Lumigo shared scripts (ie. utils/common_bash/defaults/deploy.sh
), ensure that all relevant package.json
files in your project's create_aws_resources
sub-folders include the following:
"devDependencies": {
"@lumigo/serverless-crossaccount-ssm": "^1.3.4",
...
}
Add the plugin to the top of the plugins list in your serverless.yml
file:
plugins:
- "@lumigo/serverless-crossaccount-ssm"
...
You will now need to provide a custom.crossaccount-ssm
entry:
custom:
crossaccount-ssm:
enable: true
profile: PROFILE_NAME # for ssm references resolution
regions:
- us-west-2
- us-west-1 # failover replica
- us-east-1 # failover replica
#...
If no entry is configured, the following default configuration will be used:
custom:
crossaccount-ssm:
enable: true
profile: default
regions:
- us-east-1
In this case, the default
profile must have permissions to access the secret manager or the resolution will fail.
Key | Required | Type | Default | Description |
---|---|---|---|---|
enable | no | Union[bool,str] | true | Resolution enabling switch (if false , then the variable will be always resolved to the originally passed string) |
profile | yes | str | default | AWS profile name |
regions | yes | List[str] | ["us-east-1"] | Regions with secrets replicas (including the master) |
If enable
switch is defined, it is considered false
only if not equal to:
true
"True"
, "true"
"Yes"
, "yes"
The primary region for the secret manager is Oregon (us-west-2
), with N. California (us-west-1
) and N. Virginia (us-east-1
) replicating. The choice of region order for resolving secrets is up to you.
The secret reference will not be resolved if the secret reference includes the not-available marker NA
, e.g. ${ssm:/aws/reference/secretsmanager/secret_NA~true}
All variables are resolved and set through the environment during CloudFormation template generation:
service:
name: client-demo
custom:
crossaccount-ssm:
profile: PROFILE
regions:
- MASTER_REGION
- FAILOVER_REGION_1
# ...
- FAILOVER_REGION_N
provider:
name: aws
region: us-east-1
functions:
client:
description: Isolated AWS SecretsManager' secrets client
handler: ...
environment:
CLIENT_SECRET: ${ssm:/aws/reference/secretsmanager/secret~true}
package:
include:
- ...
plugins:
- "@lumigo/serverless-crossaccount-ssm"
npm run test:all
FAQs
Serverless framework plugin to access the system and secrets managers at isolated account
We found that @lumigo/serverless-crossaccount-ssm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Product
Socket Firewall is a free tool that blocks malicious packages at install time, giving developers proactive protection against rising supply chain attacks.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.