aws_ssm_parameter resource

[edit on GitHub]

Use the aws_ssm_parameter InSpec audit resource to test properties of a ssm parameter.

Syntax

An aws_ssm_parameter resource block uses the parameter to select a ssm parameter.

describe aws_ssm_parameter(name: 'ssm-parameter-name-1234') do
  it { should exist }
end

Parameters

name (required)

This resource accepts a single parameter, the SSM Parameter Name. This can be passed either as a string or as a aws_ssm_parameter: 'value' key-value entry in a hash.

with*decryption *(optional)_

This decrypts the value associated with the ssm parameter. This must be passed as a string with_decryption: "true".

See also the AWS documentation on SSM Parameters.

Properties

For a comprehensive list of properties available, see the API reference documentation

Examples

Check the Name of a SSM Parameter

describe aws_ssm_parameter(name: 'ssm_parameter-name-1234') do
  its('name')  { should eq 'ssm_parameter-name-1234' }
end

Matchers

This InSpec audit resource has the following special matchers. For a full list of available matchers, please visit our matchers page.

exist

The control will pass if the describe returns at least one result.

Use should_not to test the entity should not exist.

describe aws_ssm_parameter(name: 'ssm_parameter-name-1234') do
  it { should exist }
end

describe aws_ssm_parameter(name: 'ssm_parameter-name-6789') do
  it { should_not exist }
end

AWS Permissions

Your Principal will need the ssm:GetParameter action with Effect set to Allow.

You can find detailed documentation at Actions, Resources, and Condition Keys for Amazon Systems Manager.