AWS SSM Parameter Store (IAM role)

Move parameters to and from an SSM path.

The connection

What	This provider
Vendor	Amazon Web Services
Key	`aws-ssm-role`
Availability	`available`. You can connect it today.
Credential penv holds	`aws-role`
Values read back	yes
Activation	`immediate`

What it moves

Direction	What it does
`import`	Reads names and values out of the store into penv.
`export`	Writes names and values from penv into the store.

When a written value goes live

immediate. The running app sees a new value at once.

What happens to a name that exists

Direction	Policies you can pick
`import`	`skip_existing`, `new_version`, `fail`
`export`	`create_only`, `overwrite`, `overwrite_and_prune`

How syncs work says what each one does.

How you connect

You grant penv access in your own AWS account. Pick one of these in the wizard.

penv generates the shared value the grant is conditioned on, so there is nothing for you to invent.

CloudFormation: recommended, fastest and most secure

One pre-filled stack; Penv-cloud is connected when it finishes. Follow a prepared link into the vendor's console. The vendor calls penv back when the grant lands.

Set aside about 2 minutes.

Confirm you're signed into the AWS account you want to connect. Switch accounts first if you are not.
Open the pre-filled Create Stack page and tick the IAM acknowledgement.
Create the stack and leave this tab open; it flips to Connected on its own.

Terraform

Review the grant in code, then paste the role ARN back. Apply a rendered policy or template. You paste the result back into the wizard.

Set aside about 10 minutes.

Add the snippet to your AWS account's Terraform and apply it.
Paste the penv_role_arn output back here.

It gives you:

Name	Label	Kind	What it is
`snippet`	Terraform	read only, a block to copy
`externalId`	External ID	read only, filled in for you	Already baked into the snippet. Only Penv-cloud can assume the role with it.

You paste back:

Field	Label	Kind	Required	What it is
`roleArn`	Role ARN	text	yes	The ARN the grant printed. We assume it once to check it before saving.

Manual

Create the role manually from the two policies below. Paste a credential you already hold. You paste the result back into the wizard.

Set aside about 10 minutes.

In IAM, create a role for another AWS account and paste the trust policy below.
Attach the permissions policy below as an inline policy.
Paste the role's ARN back here.

It gives you:

Name	Label	Kind	What it is
`penvAccountId`	Penv-cloud AWS account ID	read only, filled in for you	The account the role trusts.
`roleName`	Suggested role name	read only, filled in for you	Unique to this attempt, so it cannot collide with a role another connection made.
`externalId`	External ID	read only, filled in for you	Required in the trust policy. Only Penv-cloud can assume the role with it.
`trustPolicy`	Trust policy	read only, a block to copy
`permissionsPolicy`	Permissions policy	read only, a block to copy

You paste back:

Field	Label	Kind	Required	What it is
`roleArn`	Role ARN	text	yes	The ARN the grant printed. We assume it once to check it before saving.

What the connection asks for

Fixed when you connect, and shared by every mapping on it.

Field	Label	Kind	Required	Advanced	What it is
`region`	Region	text	yes	no	The region this connection reaches. One connection covers one region.
`accountId`	Account ID	text	no	yes	If supplied, the generated policy names the account instead of a wildcard.
`basePath`	Base path	text	yes	no	The widest SSM path this connection may touch. Every sync scope will sit under it.
`roleArn`	Role ARN	read only, filled in for you	yes	no	The role we assume. Filled in by the grant you just completed.
`engineRoleArns`	Assumable engine roles	text	no	yes	Only for dynamic secrets, and fixed once the connection exists. Comma-separated role ARNs this connection may assume; leave empty to grant none.

What a mapping asks for

Answered once per environment you map.

Field	Label	Kind	Required	Advanced	What it is
`path`	SSM path	text	yes	no	Maps onto this environment. Will sit under the connection's base path.
`recursive`	Include nested paths	yes or no	yes	yes	Nested SSM paths become the parameter's path prefix with us. Starts at `true`.

Permissions it needs

penv probes for these when it verifies the connection.

Permission	Directions	Blocking	Without it
`sts:GetCallerIdentity`	every direction	yes	We cannot confirm which IAM identity this credential is.
`ssm:GetParametersByPath`	every direction	yes	Preview cannot list what is under this path.
`kms:Decrypt`	`import`	no	SecureString parameters will import empty
`ssm:PutParameter`	`export`	yes	Export cannot write anything.
`kms:Encrypt`	`export`	yes	Export cannot write SecureString parameters.
`ssm:DeleteParameter`	`export`	no	The overwrite_and_prune policy cannot remove remote keys.

AWS SSM Parameter Store (IAM role)

On this page