Stop Console Clicking: Managing Multi-Environment AWS Parameter Store with YAML and GitHub Actions

parameters:
  # Parameters with different values per environment
  - key: api/endpoint
    description: "API endpoint"
    environment_values:
      dev:  "https://dev-api.example.com"
      stg:  "https://stg-api.example.com"
      prod: "https://prod-api.example.com"

  # Common value across all environments
  - key: app/timeout
    description: "Timeout setting (seconds)"
    default_value: "30"

  # Sensitive information (SecureString)
  # Value retrieved from GitHub Secrets via environment variables (e.g., SSM__DB__PASSWORD)
  - key: db/password
    description: "Database password"
    type: "SecureString"

$ tree .github
.github
├── aws-params.yml
├── scripts
│   ├── aws_param_common.py
│   └── update_aws_params.py
└── workflows
    └── sync-parameters.yml

YAML key: db/password
→ Environment variable: SSM__DB__PASSWORD

#!/usr/bin/env python3
"""AWS Parameter Store Common Functions"""

import os
import sys
import json
import subprocess
from typing import Dict, Any, Tuple
import yaml


def get_env_name() -> str:
    """Get environment name"""
    env = os.environ.get("ENV_NAME")
    if not env:
        print("Error: ENV_NAME environment variable is not set")
        sys.exit(1)
    return env


def get_prefix(env: str) -> str:
    """Return prefix based on environment"""
    return f"/{env}/app/config/"


def load_yaml_config() -> Tuple[Dict[str, Any], set]:
    """Load YAML file"""
    yaml_path = os.path.join(os.path.dirname(__file__), "..", "aws-params.yml")
    with open(yaml_path, "r", encoding="utf-8") as f:
        config = yaml.safe_load(f)
    yaml_keys = {param["key"] for param in config.get("parameters", [])}
    return config, yaml_keys


def get_existing_params(env: str) -> Dict[str, Dict[str, Any]]:
    """Get existing parameters from AWS SSM (with pagination support)"""
    prefix = get_prefix(env)
    existing_params = {}
    next_token = None

    while True:
        cmd = [
            "aws", "ssm", "get-parameters-by-path",
            "--path", prefix,
            "--recursive",
            "--with-decryption",
            "--output", "json"
        ]
        if next_token:
            cmd.extend(["--next-token", next_token])

        try:
            result = subprocess.run(cmd, check=True, capture_output=True, text=True)
            data = json.loads(result.stdout)
            params_data = data.get("Parameters", [])
        except subprocess.CalledProcessError as e:
            print(f"Warning: Failed to get parameters: {e.stderr}")
            return {}

        for param in params_data:
            key = param["Name"].replace(prefix, "")
            existing_params[key] = {
                "value": param["Value"],
                "type": param["Type"],
                "version": param.get("Version", 1)
            }

        next_token = data.get("NextToken")
        if not next_token:
            break

    return existing_params


def get_param_value(param: Dict[str, Any], env: str) -> str | None:
    """Get parameter value (SecureString from env vars, others from YAML)"""
    # For SecureString, get from environment variable
    if param.get("type") == "SecureString":
        env_var_name = "SSM__" + param["key"].upper().replace("/", "__")
        value = os.environ.get(env_var_name)
        if not value:
            print(f"Warning: Environment variable {env_var_name} for SecureString {param['key']} is not set")
            return None
        return value

    # Environment-specific value
    env_values = param.get("environment_values", {})
    if env in env_values:
        return str(env_values[env])

    # Default value
    if "default_value" in param:
        return str(param["default_value"])
    return None


def validate_param(param: Dict[str, Any], env: str) -> Tuple[bool, str, Dict[str, Any] | None]:
    """Validate parameter"""
    key = param.get("key")
    if not key:
        return False, "key is not defined", None

    value = get_param_value(param, env)
    if value is None:
        return False, f"{key}: value for environment {env} is not defined", None

    param_info = {
        "key": key,
        "value": value,
        "type": param.get("type", "String"),
        "description": param.get("description", "")
    }
    return True, "", param_info


def update_parameter(param_info: Dict[str, Any], env: str) -> bool:
    """Update parameter"""
    prefix = get_prefix(env)
    full_name = prefix + param_info["key"]

    cmd = [
        "aws", "ssm", "put-parameter",
        "--name", full_name,
        "--value", param_info["value"],
        "--type", param_info["type"],
        "--overwrite"
    ]
    if param_info.get("description"):
        cmd.extend(["--description", param_info["description"]])

    try:
        subprocess.run(cmd, check=True, capture_output=True, text=True)
        add_tags(full_name, env)  # Add tags
        return True
    except subprocess.CalledProcessError as e:
        print(f"Error: Failed to update {param_info['key']}: {e.stderr}")
        return False


def add_tags(parameter_name: str, env: str) -> bool:
    """Add tags to parameter"""
    cmd = [
        "aws", "ssm", "add-tags-to-resource",
        "--resource-type", "Parameter",
        "--resource-id", parameter_name,
        "--tags",
        f"Key=Environment,Value={env}",
        "Key=SID,Value=backend-api"
    ]
    try:
        subprocess.run(cmd, check=True, capture_output=True, text=True)
        return True
    except subprocess.CalledProcessError as e:
        print(f"Warning: Failed to add tags: {e.stderr}")
        return False

#!/usr/bin/env python3
"""AWS Parameter Store Update Script"""

import sys
import aws_param_common as common


def update_parameters():
    """Update parameters and report results"""
    env = common.get_env_name()
    print(f"=== Environment: {env} ===")
    print(f"Prefix: {common.get_prefix(env)}")
    print()

    config, yaml_keys = common.load_yaml_config()
    existing_params = common.get_existing_params(env)
    print(f"Existing parameters: {len(existing_params)}")
    print()

    updated_params = []
    skipped_params = []
    failed_params = []

    for param in config.get("parameters", []):
        is_valid, error_msg, param_info = common.validate_param(param, env)

        if not is_valid:
            print(f"[Skip] {error_msg}")
            continue

        param_key = param_info["key"]
        value = param_info["value"]

        # Compare with existing value
        if param_key in existing_params:
            if existing_params[param_key]["value"] == value:
                print(f"[Skip] {param_key}: no change")
                skipped_params.append(param_key)
                continue
            print(f"[Update] {param_key}: updating value")
        else:
            print(f"[New] {param_key}: adding new parameter")

        # Update parameter
        success = common.update_parameter(param_info, env)
        if success:
            updated_params.append(param_key)
            print(f"  ✓ Done")
        else:
            failed_params.append(param_key)
            print(f"  ✗ Failed")

    # Result summary
    print()
    print("=== Summary ===")
    print(f"Updated: {len(updated_params)}")
    print(f"Skipped (no change): {len(skipped_params)}")
    print(f"Failed: {len(failed_params)}")

    if failed_params:
        print()
        print("Failed parameters:")
        for key in failed_params:
            print(f"  - {key}")
        sys.exit(1)

    print()
    print("✓ Completed successfully")


if __name__ == "__main__":
    update_parameters()

name: Sync AWS Parameter Store

on:
  workflow_dispatch:  # Manual trigger

jobs:
  sync-parameters:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        env: [dev, stg, prod]
    environment: ${{ matrix.env }}  # Use environment-specific Secrets

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install dependencies
        run: pip install pyyaml

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ap-northeast-1

      - name: Sync Parameters
        env:
          ENV_NAME: ${{ matrix.env }}
          # For SecureString (from environment-specific GitHub Secrets)
          SSM__DB__PASSWORD: ${{ secrets.SSM__DB__PASSWORD }}
          SSM__API__SECRET_KEY: ${{ secrets.SSM__API__SECRET_KEY }}
        run: |
          cd .github/scripts
          python update_aws_params.py

parameters:
  # Add new parameter
  - key: feature/enable_payment_v2
    description: "Enable new payment system"
    environment_values:
      dev:  "true"
      stg:  "false"
      prod:  "false"

- key: payment/api_key
  description: "Payment API key"
  type: "SecureString"

Secret name: SSM__PAYMENT__API_KEY
Value: (actual value, different per environment)

env:
  SSM__PAYMENT__API_KEY: ${{ secrets.SSM__PAYMENT__API_KEY }}