@continuous-excellence/ze-great-dashboard-aws 0.11.0 → 0.12.0

package/README.md

@@ -21,12 +21,12 @@ AWS to try it.
 
 The included deployment works out of the box with public GitHub repositories and HTTP endpoints
 that do not require credentials. For private GitHub sources, `SecretReference` is the ARN of one
-consumer-owned Secrets Manager JSON map (for example, `{"GITHUB_TOKEN":"github_pat_…"}`). The
-runtime resolves configured `token_env` names only at Lambda cold start and never exposes token
-values to the browser, API responses, logs, CloudFormation parameters, or Lambda environment.
-This is the one added runtime dependency: AWS's Secrets Manager client supplies IAM-authenticated
-`GetSecretValue` support in the bundled Lambda, at the cost of its bundled SDK code and a single
-cold-start request when private sources are configured.
+consumer-owned Secrets Manager JSON map or Parameter Store `SecureString` (for example,
+`{"GITHUB_TOKEN":"github_pat_…"}`). The runtime resolves configured `token_env` names only at
+Lambda cold start and never exposes token values to the browser, API responses, logs,
+CloudFormation parameters, or Lambda environment. The two added AWS SDK clients provide
+IAM-authenticated `GetSecretValue` and decrypted `GetParameter` support in the bundled Lambda, at
+the cost of their bundled code and one cold-start request when private sources are configured.
 
 ## Deployment map
 

package/bootstrap/core-v1.yml

@@ -14,7 +14,7 @@ Parameters:
   RuntimeSecretArn:
     Type: String
     Default: ''
-    Description: Optional explicitly configured Secrets Manager secret ARN
+    Description: Optional explicitly configured Secrets Manager secret or Parameter Store SecureString ARN
   ArtifactKmsKeyArn:
     Type: String
     Default: ''
@@ -97,15 +97,33 @@ Resources:
                 Condition: { StringEquals: { 'iam:PassedToService': lambda.amazonaws.com } }
               - !If
                 - HasRuntimeSecret
-                - Sid: ReadConfiguredRuntimeSecret
+                - Sid: ReadConfiguredRuntimeCredentials
                   Effect: Allow
                   Action: [secretsmanager:DescribeSecret, secretsmanager:GetSecretValue]
                   Resource: !Ref RuntimeSecretArn
                 - !Ref AWS::NoValue
+              - !If
+                - HasRuntimeSecret
+                - Sid: ReadConfiguredRuntimeParameter
+                  Effect: Allow
+                  Action: ssm:GetParameter
+                  Resource: !Ref RuntimeSecretArn
+                - !Ref AWS::NoValue
+              - !If
+                - HasRuntimeSecret
+                - Sid: DecryptConfiguredRuntimeParameter
+                  Effect: Allow
+                  Action: kms:Decrypt
+                  Resource: '*'
+                  Condition:
+                    StringEquals:
+                      'kms:ViaService': !Sub 'ssm.${AWS::Region}.amazonaws.com'
+                      'kms:EncryptionContext:PARAMETER_ARN': !Ref RuntimeSecretArn
+                - !Ref AWS::NoValue
 
 Outputs:
   BootstrapContractVersion: { Value: '1' }
-  BootstrapTemplateRevision: { Value: '1.1' }
+  BootstrapTemplateRevision: { Value: '1.2' }
   ArtifactBucketName: { Value: !Ref ArtifactBucket }
   ArtifactBucketArn: { Value: !GetAtt ArtifactBucket.Arn }
   CloudFormationExecutionRoleArn: { Value: !GetAtt CloudFormationExecutionRole.Arn }

package/dist/cli.js

@@ -820,7 +820,7 @@ async function assembleRelease(input) {
   const board = await validateBoardConfig(input.boardConfigPath);
   if (board.usesCredentials && !input.secretReference)
     throw new Error(
-      "Board config uses token_env; SecretReference must name the Secrets Manager credential-map ARN"
+      "Board config uses token_env; SecretReference must name a Secrets Manager credential-map or Parameter Store SecureString ARN"
     );
   const outputDir = resolve(input.outputDir);
   await mkdir(outputDir, { recursive: true });

package/dist/index.js

@@ -807,7 +807,7 @@ async function assembleRelease(input) {
   const board = await validateBoardConfig(input.boardConfigPath);
   if (board.usesCredentials && !input.secretReference)
     throw new Error(
-      "Board config uses token_env; SecretReference must name the Secrets Manager credential-map ARN"
+      "Board config uses token_env; SecretReference must name a Secrets Manager credential-map or Parameter Store SecureString ARN"
     );
   const outputDir = resolve(input.outputDir);
   await mkdir(outputDir, { recursive: true });