AWS Parameter Store Usage

AWS Login

• Create a user and an IAM user in AWS
• In IAM user go to details and Create Access Key. We'll need it in aws cli later
• Login as IAM https://<IAM_USER>.signin.aws.amazon.com/console

Create Store

• Go to AWS Systems Manager > Parameter Store or search parameter store in the search box
• Click Create Parameter (Note the region)
• Give a name and value. Save it
  • Parameter naming convention is /environment/app-name/key

Accessing it from AWS CLI

• Install AWS CLI
• Configure it by

aws configure

• • AWS_ACCESS_KEY_ID it's the key we created earlier
  • AWS_SECRET_ACCESS_KEY
  • region it's the region where we created our parameter store above
  • output format text / json / table
• Some Commands
  • List all parameters : aws ssm describe-parameters
  • Get a plain-text parameter : aws ssm get-parameter --name gizli --output [text|json] [--query "Parameter.Value"]
  • Get an encrypted (SecureString) parameter : aws ssm get-parameter --name "/my/secret/dbPassword" --with-decryption --query "Parameter.Value" --output text
  • Store a parameter : aws ssm put-parameter --name "/my/app/param" --value "hello-world" --type String --overwrite

Accessing from Node

import { SSMClient, GetParameterCommand } from "@aws-sdk/client-ssm";

const client = new SSMClient({ region: "us-east-1" });

const command = new GetParameterCommand({
  Name: "/gizli",
  WithDecryption: true,
});

const response = await client.send(command);
console.log(response?.Parameter?.Value);

Accessing from Github Actions

Give GitHub OIDC permissions (recommended, no long-lived credentials)

In AWS IAM, create a role that allows GitHub OIDC access with this permission:

{
  "Effect": "Allow",
  "Action": [
    "ssm:GetParameter",
    "ssm:GetParameters"
  ],
  "Resource": "arn:aws:ssm:us-east-1:123456789012:parameter/my/secret/*"
}

Use SSM inside the GitHub Action

name: Get SSM Params
on: [workflow_dispatch]

permissions:
  id-token: write
  contents: read

jobs:
  read_ssm:
    runs-on: ubuntu-latest
    steps:
      - name: Configure AWS
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/GitHubOIDCRole
          aws-region: us-east-1

      - name: Fetch SSM Parameter
        id: ssm
        run: |
          VALUE=$(aws ssm get-parameter \
            --name "/my/secret/dbPassword" \
            --with-decryption \
            --query "Parameter.Value" \
            --output text)
          echo "value=$VALUE" >> $GITHUB_OUTPUT

      - name: Use the value
        run: echo "Secret was retrieved!"