-: So let's use the Systems Manager parameter store.
And for this, I'm just going to type parameter
and it takes me directly to Systems Manager.
You could also type systems manager to find the UI.
So within Systems Manager now,
to find the parameters store,
on the left hand side you have to scroll all the way down
and you'll find it right here,
second to last, Parameter Store.
So the Parameter Store is for secrets
and configuration data management
and it is a way to centralize all these parameters
within your AWS accounts, which is great.
So here you can see how it works.
You create a new parameter,
then you specify the parameter type and value,
and you reference that parameter
from within your commands on your code,
which is exactly what we're going to do.
So for this, to get started,
click on create parameter.
So here I'll create a parameter called my-app,
and it's in the dev environment.
And the first one is a database URL.
And so I'll say database URL for my app in development.
Okay.
Now here we can have three type of types,
we can have a String,
and we can put whatever characters we want.
StringList, you have a list of strings using commas,
or SecureString, what it's encrypted.
Let's go with String first.
And so for example, here is a database URL.
So you can put whatever you want,
but it has to be 4096 characters.
So let's go ahead and say,
dev.database.stephanetheteacher.com.
And that's just something very random,
and maybe I'll add the port 3306.
So it's just whatever you want it to be, okay.
So here's just a random URL for me,
dev.database.stephanetheteacher.com:3306.
I'll go ahead and create that parameter.
And so here, the create parameter request succeeded.
And we have our first parameter.
Turns out that we can see the description,
the type and also the version.
So if we ever modify this parameter,
we'll get a last modified data that will be new,
and the last modify user that will be tracked as well,
so we can know who modified what.
If I click on this, again you get a summary.
You can see the history of the values,
and you can see the tags.
And we have our db-url.
So what I want to do is maybe create another parameter,
so I'll create a parameter
and this time, I call it db-password for our database.
And so I'll just say database password
from my app in development.
And here I have a SecureString,
so this time we're going to encrypt our secret.
And so we'll use KMS to encrypting.
We can use our current account or another account.
For our KMS key source we'll use our current account.
And we can use the AWS provided key, okay,
but we also can use the key we've created from before
so I've created a tutorial KMS key from before.
And so we can just use that one as well.
It's whatever you prefer based on how
you wanna manage your security.
So I'll use the my tutorial.
And here's the value.
And I'll say, this is the dev password.
And we don't see it because it's a secret value,
and this will be encrypted.
So I'll create the parameter.
And now we see that we have a new parameter right here,
called dev/db-password.
It's a SecureString now so that means it's encrypted
and the key ID is alias/tutorial, and the version is one.
If I click on it, we can see that the value is hidden,
but I can click on show,
and this will decrypt the value for me on the fly
and say this is the dev password.
So this is pretty cool now,
because what we can do is definitely copy these
and so we're going to do it again but this time in prod.
So let's go ahead and create parameters.
I'll create this in prod.
So I'll just change a bit, the path,
and I'll say database URL,
URL for my app in prod.
And I'll just be quick,
prod.database.stephanetheteacher.com:3306.
I'll create it.
And I'll just create one last parameter.
And we're going to create the db-password in prod
and the description is going to be in production
and SecureString, I'll use my same tutorial value
and here I'll say prod password, okay.
I'll create the parameter.
So now we have four parameters
and we want to be able to access them.
So what we can do is access them,
for example, using this CLI first.
So we are going to use this CLI to get the parameters.
So it's called get-parameters.
And you have to provide a names
and for this we have to provide
the names of the parameters we want.
So for me, I'll just say I want
my db-url and my db-password, and press Enter.
And now we get back from the API, two results.
We get the db-password back and the db-url.
So let's look at the result, right.
The first one is that it's a String for the db-url,
and here's the value of the String.
And as you can see, because it was not encrypted,
the value comes back decrypted,
and the version is one.
So that's perfect, we can see our database URL and use this.
But for the password it's a SecureString,
and here is the value of it,
which is an encrypted value.
So for this, you basically need to decrypt it.
And for this you have a special parameter
and it's called with-decryption,
so I'll do with-decryption.
And so this will check whether or not
I have the KMS permission to decrypt
this secret that was encrypted with the KMS tutorial key.
So press Enter.
And now this time, for my SecureString,
the value has been decrypted
because I specified the with-decryption parameter.
And so this is pretty cool
because very, very quickly,
we're able to have encrypted values
and people that can't access them
because they don't have access to KMS
that protects my password.
But if I have access to KMS,
I'll just provide one extra flag with-decryption
and here we go,
I get the value of my dev password.
So it's really, really neat.
The other thing we can do is
do aws ssm get-parameters-by-path
and lets go to the help.
So the get-parameters-by-path
allows us to go through a path
and we have to provide the path name.
And it has to start with a forward slash.
So if we do get parameters by path,
and I'm going to delete this,
I'm just going to keep my-app/dev/.
And I'll say get-parameters-by-path
and the path is going to be this.
Then this is going to query
for all the parameters under this path.
And this is why we have a tree structure.
And what we get out of it, obviously,
is dependent on we had from before.
So what we could do now is go one level up to just my-app,
and you --recursive to get
all the parameters recursively under my-app.
Press Enter and now we get our four parameters back,
db-password, db-url, db-password for prod
and db-url for prod.
So using this tree structure,
we're basically able to organize our secrets
and get them all at once which is really neat.
So that's it.
You can also obviously provide
the with-decryption flag and get the decryption.
So that's just for this CLI,
but in the next lecture I just wanna show you
how it works with AWS Lambda
because it is very simple as well.
So see you in the next lecture.