Huge News!Announcing our $40M Series B led by Abstract Ventures.Learn More
Socket
Sign inDemoInstall
Socket

@lumigo/serverless-crossaccount-ssm

Package Overview
Dependencies
Maintainers
3
Versions
8
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@lumigo/serverless-crossaccount-ssm

Serverless framework plugin to access the system and secrets managers at isolated account

  • 1.3.6
  • latest
  • Source
  • npm
  • Socket score

Version published
Weekly downloads
327
decreased by-54.07%
Maintainers
3
Weekly downloads
 
Created
Source

lumigo-serverless-crossaccount-ssm

serverless Version CircleCI

Serverless framework plugin to access the system and secrets managers at isolated account.

Currently only the AWS provider is supported.

Usage

NOTE: secrets must be deployed by the lumigo-secure-store repository and their values set before they can be used.

Installing the plugin

Run npm install in your Serverless project.

npm install --save-dev @lumigo/serverless-crossaccount-ssm

If you're using the Lumigo shared scripts (ie. utils/common_bash/defaults/deploy.sh), ensure that all relevant package.json files in your project's create_aws_resources sub-folders include the following:

  "devDependencies": {
    "@lumigo/serverless-crossaccount-ssm": "^1.3.4",
    ...
  }

Configuring the plugin

Add the plugin to the top of the plugins list in your serverless.yml file:

plugins:
  - "@lumigo/serverless-crossaccount-ssm"
  ...

You will now need to provide a custom.crossaccount-ssm entry:

custom:
  crossaccount-ssm:
    enable: true
    profile: PROFILE_NAME # for ssm references resolution
    regions:
      - us-west-2
      - us-west-1 # failover replica
      - us-east-1 # failover replica
      #...

If no entry is configured, the following default configuration will be used:

custom:
  crossaccount-ssm:
    enable: true
    profile: default
    regions:
      - us-east-1

In this case, the default profile must have permissions to access the secret manager or the resolution will fail.

Configuration Options
KeyRequiredTypeDefaultDescription
enablenoUnion[bool,str]trueResolution enabling switch (if false, then the variable will be always resolved to the originally passed string)
profileyesstrdefaultAWS profile name
regionsyesList[str]["us-east-1"]Regions with secrets replicas (including the master)

If enable switch is defined, it is considered false only if not equal to:

  • true
  • "True", "true"
  • "Yes", "yes"

The primary region for the secret manager is Oregon (us-west-2), with N. California (us-west-1) and N. Virginia (us-east-1) replicating. The choice of region order for resolving secrets is up to you.

The 'Not-Available' marker

The secret reference will not be resolved if the secret reference includes the not-available marker NA, e.g. ${ssm:/aws/reference/secretsmanager/secret_NA~true}

Example configuration

All variables are resolved and set through the environment during CloudFormation template generation:

service:
  name: client-demo

custom:
  crossaccount-ssm:
    profile: PROFILE
    regions:
      - MASTER_REGION
      - FAILOVER_REGION_1
      # ...
      - FAILOVER_REGION_N

provider:
  name: aws
  region: us-east-1

functions:
  client:
    description: Isolated AWS SecretsManager' secrets client
    handler: ...
    environment:
      CLIENT_SECRET: ${ssm:/aws/reference/secretsmanager/secret~true}
    package:
      include:
        - ...

plugins:
  - "@lumigo/serverless-crossaccount-ssm"

Testing your plugin changes

  • Run npm run test:all

Keywords

FAQs

Package last updated on 21 Nov 2022

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc