ssm_mass_uploader

命令行工具，将通过 AWS KMS 在本地加密 ssm 机密并将加密数据上传到 ssm。

如何使用

1. 您在本地计算机上创建一个机密文件。例子。

{
  "secrets": [
    {
      "Name": "/super/secret/parameter",
      "Value": "42",
      "Type": "SecureString",
      "Overwrite": true
    }
  ]
}

有关参数选项，请参见boto 3 put parameter docs

1. 在本地加密文件

python -m ssmu -e -k {kms_id} -f path/to/file/{unencrypted_file.json} -s {stage} --o path/to/save

将输出一个名为 secret.{stage} 的文件

1. 将加密文件上传到ssm

python -m ssmu -u -k {kms_id} -f path/to/file/secret.stage -s stage

注意：Windows 和 linux\vs/

json 放入“secrets_to_upload”

注意：标签不是必需的，但如果包含它们，则键值是必需的

{
  "Name": "String [REQUIRED]",
  "Description": "String [NOT REQUIRED]",
  "Value": "String [REQUIRED]",
  "Type": "String'|'StringList'|'SecureString [REQUIRED]",
  "KeyId": "String [NOT REQUIRED]",
  "Overwrite": "BOOLEAN [NOT REQUIRED]",
  "AllowedPattern": "String [NOT REQUIRED]",
  "Tags": [
    {
      "Key": "String [REQUIRED]",
      "Value": "String [REQUIRED]"
    }
  ],
  "Tier": "'Standard'|'Advanced'|'Intelligent-Tiering' [NOT REQUIRED]",
  "Policies": "String [NOT REQUIRED]",
  "DataType": "String [NOT REQUIRED]"
}

例子

基本示例

{
  "secrets": [
    {
      "Name": "/this/is/super/secret",
      "Value": "shhhh",
      "Type": "String"
    }
  ]
}

{
  "secrets": [
    {
      "Name": "/this/is/super/secret",
      "Value": "shhhh",
      "Type": "SecureString"
    }
  ]
}

带标签的示例

{
  "secrets": [
    {
      "Name": "/this/is/super/secret",
      "Value": "shhhh",
      "Type": "String"
    },
    {
      "Name": "/this/is/another/secret",
      "Value": "hmmmm",
      "Type": "SecureString",
      "Tags": [
        {
          "Key": "Project Name",
          "Value": "Project X"
        }
      ]
    }
  ]
}

允许覆盖、安全字符串和标签的示例

注意：您不能在同一个调用中使用 Overwrite 和 tags。您应该在第一次创建时添加标签，或者稍后添加/删除标签。

{
  "secrets": [
    {
      "Name": "/this/is/super/secret",
      "Value": "new secret",
      "Type": "String",
      "Overwrite": true
    },
    {
      "Name": "/this/is/another/secret",
      "Value": "hmmmm",
      "Type": "SecureString",
      "Tags": [
        {
          "Key": "Project Name",
          "Value": "Project X"
        }
      ]
    }
  ]
}