ssm-parameter

Manages AWS Systems Manager Parameter Store parameters with KMS encryption.

Creates String, StringList, and SecureString parameters. SecureString parameters use a caller-supplied KMS key (from the security/kms module). Initial values are set on creation and then ignored to support operator-managed secret rotation. Supports Standard and Advanced tiers.

Usage

module "ssm_params" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/security/ssm-parameter/aws"
  version = "0.1.0"

  parameters = {
    db_host = {
      name  = "/prod/rds/host"
      type  = "String"
      value = "db.internal.example.com"
    }
    db_password = {
      name       = "/prod/rds/password"
      type       = "SecureString"
      value      = "changeme"
      kms_key_id = module.kms.key_id
    }
  }
}

Requirements

Name	Version
terraform	~> 1.5
aws	~> 6.50

Providers

Name	Version
aws	6.50.0

Resources

Name	Type
aws_ssm_parameter.this	resource

Inputs

Name	Description	Type	Default	Required
parameters	Map of SSM parameters to create.type is String, StringList, or SecureString.kms_key_id is required when type is SecureString.	map(object({ name = string description = optional(string, "") type = optional(string, "SecureString") value = string tier = optional(string, "Standard") kms_key_id = optional(string, null) overwrite = optional(bool, false) }))	{}	no
tags	Resource tags to apply to all resources	map(string)	{}	no

Outputs

Name	Description
parameter_arns	Map of logical key to parameter ARN
parameter_names	Map of logical key to parameter name
parameter_versions	Map of logical key to parameter version number