infrastructure.yml

AWSTemplateFormatVersion: "2010-09-09"
Resources:
  SecureParameter:
    Type: AWS::Lambda::Function
    Properties:
      Handler: index.handler
      Role: !GetAtt Role.Arn
      Runtime: nodejs16.x
      Timeout: 60
      Code:
        ZipFile: >
          var response = require('cfn-response');
          var aws = require('aws-sdk');

          exports.handler = function(event, context) {
              console.log('event', event);
          
              var ssm = new aws.SSM();
              var resourceProperties = event.ResourceProperties;

              console.log('Parsing cloudformation parameters.');
              var splitStackArn = event.StackId.split(':');
              var region = splitStackArn[3];
              var accountId = splitStackArn[4];

              var stackName = splitStackArn[5].split("/")[1];
              var paramName = stackName + "-" + event.LogicalResourceId + "-" + Math.random().toString(36).substr(2, 5); 
              var paramArn = "arn:aws:ssm:" + region + ":" + accountId + ":parameter/" + paramName;

              console.log('Preparing response callback');
              var responseCallback = function(err, resp) {
                  var cfnRespData = { Arn: paramArn, Name: paramName };
                  if (err) {
                      console.log(err);
                      response.send(event, context, response.FAILED, cfnRespData, paramArn);            
                  } else {
                      console.log(resp);
                      response.send(event, context, response.SUCCESS, cfnRespData, paramArn);            
                  }
              };

              if (event.RequestType == "Create") {
                  var params = {
                      Name: paramName,
                      Type: "SecureString",
                      Value: "_REPLACE_WITH_ACTUAL_CREDENTIAL_IN_AWS_CONSOLE_",
                      KeyId: resourceProperties.KeyId,
                      Description: resourceProperties.Description,
                      Overwrite: false
                  };

                  console.log("Creating parameter input: ", params);
                  ssm.putParameter(params, responseCallback);
              } else if (event.RequestType == "Update") {
                  var params = {
                      Name: paramName,
                      Type: "SecureString",
                      Value: resourceProperties.Value,
                      KeyId: resourceProperties.KeyId,
                      Description: resourceProperties.Description,
                      Overwrite: true
                  };

                  console.log("Updating parameter input: ", params);
                  ssm.putParameter(params, responseCallback);
              } else if (event.RequestType == "Delete") {
                  var deleteParam = { Name: event.PhysicalResourceId.split('parameter/')[1] };
                  console.log("Deleting parameter: ", deleteParam);
                  ssm.deleteParameter(deleteParam, responseCallback);
              }
          };
  Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal: { Service: [ lambda.amazonaws.com ] }
            Action: [ sts:AssumeRole ]
      Policies:
        - PolicyName: SecureParameter
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action: [ logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents ]
                Resource: arn:aws:logs:*:*:*
              - Effect: Allow
                Action: [ "ssm:PutParameter", "ssm:DeleteParameter" ]
                Resource: !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:*/*"
              - Effect: Allow
                Action: [ "kms:Encrypt" ]
                Resource: !Sub "arn:aws:kms:${AWS::Region}:${AWS::AccountId}:key/*"
Outputs:
  SecureParameter:
    Description: Cloudformation polyfill for SSM parameter store secure string.
    Value: !GetAtt SecureParameter.Arn
    Export:
      Name: CfnSecureParameter