AWS SSM

Configure credentials, IAM permissions, and a test parameter for AWS SSM Parameter Store.

AWS setup

Everything you need to use Envilder with AWS SSM Parameter Store.

1. Configure credentials

Envilder uses your AWS CLI credentials. Set up the default profile:

aws configure

Or use a named profile for multi-account setups:

aws configure --profile dev-account

2. Grant IAM permissions

Your IAM user or role needs access to SSM parameters:

Operation	Permission
Pull	`ssm:GetParameter`
Push	`ssm:PutParameter`

Example IAM policy (scope to your path prefix):

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["ssm:GetParameter", "ssm:PutParameter"],
    "Resource": "arn:aws:ssm:us-east-1:123456789012:parameter/myapp/*"
  }]
}

3. Create a test parameter and verify

Push a test secret with Envilder, which also writes the map file, then pull it back to confirm everything works:

# 1. Push a test secret; Envilder also writes aws-test-map.json
envilder --push --provider=aws --map=aws-test-map.json --key=HELLO --value=world --secret-path=/test/hello

# 2. Pull it back with Envilder
envilder --map=aws-test-map.json --envfile=.env

If you see ⭐ LEVEL CLEARED, your AWS setup is complete.

Or load secrets directly from your app with the Python SDK:

from envilder import Envilder

secrets = Envilder.load("aws-test-map.json")
print(secrets["HELLO"])  # world