Confd with SSM Parameter Store

Confd Dynamic Configuration Management with SSM Parameter Store

The Parameter Store has the ability to store three different types of data, which can then be programmatically accessed via the SSM API.

The three types of data are:

  • String
  • String List and
  • Secure String.
Let's focuse on the String & Secure String options and how it can be used to store and retrieve secrets within your AWS environment with Confd.

Before we can ask confd to update our configuration files, let's store some data with SSM in the Parameter Store:

aws ssm put-parameter --name "/univrs/data/url" --type "String" --value "univrs.io"
aws ssm put-parameter --name "/univrs/data/user" --type "SecureString" --value "ubuntu"

Let's view them:

0> aws ssm get-parameter --name "/univrs/data/user"
{
    "Parameter": {
        "Type": "SecureString", 
        "Name": "/univrs/data/user", 
        "Value": "AQICAHh2+A9IplQTefNHcvox10nRuvOaghThI6OpBgCnH/+Q8AHP7Rpt8/TMAFSVvaF+ekeWAAAAZDBiBgkqhkiG9w0BBwagVTBTAgEAME4GCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMUPBsqHZ1ycWfOBZPAgEQgCEVfafxR66BqOrVSI/Jglf+yRNQnO8w0EcOXYu0hkycjX4="
    }
}
[root@univrs]:~
0> aws ssm get-parameter --name "/univrs/data/url"
{
    "Parameter": {
        "Type": "String", 
        "Name": "/univrs/data/url", 
        "Value": "univrs.io"
    }
}

Great! Now let's get confd to use ssm as the backend store

[root@univrs]:/etc/confd/conf.d
0> confd -onetime -backend ssm
2018-03-17T15:54:09Z univrs confd[4381]: INFO Backend set to ssm
2018-03-17T15:54:09Z univrs confd[4381]: INFO Starting confd
2018-03-17T15:54:09Z univrs confd[4381]: INFO Backend source(s) set to 
2018-03-17T15:54:10Z univrs confd[4381]: INFO Target config /tmp/univrs.conf out of sync
2018-03-17T15:54:10Z univrs confd[4381]: INFO Target config /tmp/univrs.conf has been updated

Our Configuration file /tmp/univrs.conf has been updated!

0> cat /tmp/univrs.conf 
[univrs]
univrs_url = univrs.io
univrs_user = ubuntu

But how did confd know where to find the values for our /tmp/unvirs.conf file?

Lets look at the Toml file in /etc/confd/conf.d:

[root@univrs]:/etc/confd/conf.d
0> cat univrs.toml
[template]
src = "univrs.conf.tmpl"
dest = "/tmp/univrs.conf"
keys = [
   "/univrs/data/url",
   "/univrs/data/user",
]

What does our template look like?

[root@univrs]:/etc/confd/conf.d
0> ls
univrs.toml
[root@univrs]:/etc/confd/conf.d
0> ls ../
conf.d  templates
[root@univrs]:/etc/confd/conf.d
0> cat ../templates/univrs.conf.tmpl 
[univrs]
univrs_url = {{ getv "/univrs/data/url" }}
univrs_user = {{ getv "/univrs/data/user" }}


Documentation

https://github.com/univrs/confd

AWS Parameter Store can be found here:

http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/systems-manager-paramstore.html

Using Paramter Store with CloudFormation

Integrating AWS CloudFormation with AWS Systems Manager Parameter Store