【脱コンソールポチポチ】多環境AWS Parameter StoreをYAML×GitHub Actionsで一元管理する仕組みを作った

parameters:
  # 環境ごとに値が異なるパラメータ
  - key: api/endpoint
    description: "APIエンドポイント"
    environment_values:
      dev:  "https://dev-api.example.com"
      stg:  "https://stg-api.example.com"
      prod: "https://prod-api.example.com"

  # 全環境で共通の値
  - key: app/timeout
    description: "タイムアウト設定（秒）"
    default_value: "30"

  # 機密情報（SecureString）
  # 値はGitHub Secretsから環境変数経由で取得（例: SSM__DB__PASSWORD）
  - key: db/password
    description: "データベースパスワード"
    type: "SecureString"

$ tree .github
.github
├── aws-params.yml
├── scripts
│   ├── aws_param_common.py
│   └── update_aws_params.py
└── workflows
    └── sync-parameters.yml

YAMLのkey: db/password
→ 環境変数名: SSM__DB__PASSWORD

#!/usr/bin/env python3
"""AWS Parameter Store 共通処理"""

import os
import sys
import json
import subprocess
from typing import Dict, Any, Tuple
import yaml


def get_env_name() -> str:
    """環境名を取得"""
    env = os.environ.get("ENV_NAME")
    if not env:
        print("エラー: ENV_NAME 環境変数が設定されていません")
        sys.exit(1)
    return env


def get_prefix(env: str) -> str:
    """環境に応じたプレフィックスを返す"""
    return f"/{env}/app/config/"


def load_yaml_config() -> Tuple[Dict[str, Any], set]:
    """YAMLファイルを読み込む"""
    yaml_path = os.path.join(os.path.dirname(__file__), "..", "aws-params.yml")
    with open(yaml_path, "r", encoding="utf-8") as f:
        config = yaml.safe_load(f)
    yaml_keys = {param["key"] for param in config.get("parameters", [])}
    return config, yaml_keys


def get_existing_params(env: str) -> Dict[str, Dict[str, Any]]:
    """AWS SSMから既存のパラメータを取得（ページネーション対応）"""
    prefix = get_prefix(env)
    existing_params = {}
    next_token = None

    while True:
        cmd = [
            "aws", "ssm", "get-parameters-by-path",
            "--path", prefix,
            "--recursive",
            "--with-decryption",
            "--output", "json"
        ]
        if next_token:
            cmd.extend(["--next-token", next_token])

        try:
            result = subprocess.run(cmd, check=True, capture_output=True, text=True)
            data = json.loads(result.stdout)
            params_data = data.get("Parameters", [])
        except subprocess.CalledProcessError as e:
            print(f"警告: パラメータの取得に失敗しました: {e.stderr}")
            return {}

        for param in params_data:
            key = param["Name"].replace(prefix, "")
            existing_params[key] = {
                "value": param["Value"],
                "type": param["Type"],
                "version": param.get("Version", 1)
            }

        next_token = data.get("NextToken")
        if not next_token:
            break

    return existing_params


def get_param_value(param: Dict[str, Any], env: str) -> str | None:
    """パラメータの値を取得（SecureStringは環境変数、それ以外はYAMLの値を使用）"""
    # SecureStringの場合は環境変数から取得
    if param.get("type") == "SecureString":
        env_var_name = "SSM__" + param["key"].upper().replace("/", "__")
        value = os.environ.get(env_var_name)
        if not value:
            print(f"警告: SecureString {param['key']} の環境変数 {env_var_name} が未設定")
            return None
        return value

    # 環境固有の値
    env_values = param.get("environment_values", {})
    if env in env_values:
        return str(env_values[env])

    # デフォルト値
    if "default_value" in param:
        return str(param["default_value"])
    return None


def validate_param(param: Dict[str, Any], env: str) -> Tuple[bool, str, Dict[str, Any] | None]:
    """パラメータのバリデーション"""
    key = param.get("key")
    if not key:
        return False, "keyが定義されていません", None

    value = get_param_value(param, env)
    if value is None:
        return False, f"{key}: 環境 {env} の値が定義されていません", None

    param_info = {
        "key": key,
        "value": value,
        "type": param.get("type", "String"),
        "description": param.get("description", "")
    }
    return True, "", param_info


def update_parameter(param_info: Dict[str, Any], env: str) -> bool:
    """パラメータを更新"""
    prefix = get_prefix(env)
    full_name = prefix + param_info["key"]

    cmd = [
        "aws", "ssm", "put-parameter",
        "--name", full_name,
        "--value", param_info["value"],
        "--type", param_info["type"],
        "--overwrite"
    ]
    if param_info.get("description"):
        cmd.extend(["--description", param_info["description"]])

    try:
        subprocess.run(cmd, check=True, capture_output=True, text=True)
        add_tags(full_name, env)  # タグを追加
        return True
    except subprocess.CalledProcessError as e:
        print(f"エラー: {param_info['key']} の更新に失敗: {e.stderr}")
        return False


def add_tags(parameter_name: str, env: str) -> bool:
    """パラメータにタグを追加"""
    cmd = [
        "aws", "ssm", "add-tags-to-resource",
        "--resource-type", "Parameter",
        "--resource-id", parameter_name,
        "--tags",
        f"Key=Environment,Value={env}",
        "Key=SID,Value=backend-api"
    ]
    try:
        subprocess.run(cmd, check=True, capture_output=True, text=True)
        return True
    except subprocess.CalledProcessError as e:
        print(f"警告: タグの追加に失敗: {e.stderr}")
        return False

#!/usr/bin/env python3
"""AWS Parameter Store 更新スクリプト"""

import sys
import aws_param_common as common


def update_parameters():
    """パラメータを更新し、結果をレポートする"""
    env = common.get_env_name()
    print(f"=== 環境: {env} ===")
    print(f"プレフィックス: {common.get_prefix(env)}")
    print()

    config, yaml_keys = common.load_yaml_config()
    existing_params = common.get_existing_params(env)
    print(f"既存パラメータ数: {len(existing_params)}")
    print()

    updated_params = []
    skipped_params = []
    failed_params = []

    for param in config.get("parameters", []):
        is_valid, error_msg, param_info = common.validate_param(param, env)

        if not is_valid:
            print(f"[スキップ] {error_msg}")
            continue

        param_key = param_info["key"]
        value = param_info["value"]

        # 既存の値と比較
        if param_key in existing_params:
            if existing_params[param_key]["value"] == value:
                print(f"[スキップ] {param_key}: 値に変更なし")
                skipped_params.append(param_key)
                continue
            print(f"[更新] {param_key}: 値を更新します")
        else:
            print(f"[新規] {param_key}: 新規パラメータを追加します")

        # パラメータを更新
        success = common.update_parameter(param_info, env)
        if success:
            updated_params.append(param_key)
            print(f"  ✓ 完了")
        else:
            failed_params.append(param_key)
            print(f"  ✗ 失敗")

    # 結果サマリー
    print()
    print("=== 結果サマリー ===")
    print(f"更新: {len(updated_params)} 件")
    print(f"スキップ（変更なし）: {len(skipped_params)} 件")
    print(f"失敗: {len(failed_params)} 件")

    if failed_params:
        print()
        print("失敗したパラメータ:")
        for key in failed_params:
            print(f"  - {key}")
        sys.exit(1)

    print()
    print("✓ 正常終了")


if __name__ == "__main__":
    update_parameters()

name: Sync AWS Parameter Store

on:
  workflow_dispatch:  # 手動実行

jobs:
  sync-parameters:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        env: [dev, stg, prod]
    environment: ${{ matrix.env }}  # 環境ごとのSecretsを使用

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install dependencies
        run: pip install pyyaml

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ap-northeast-1

      - name: Sync Parameters
        env:
          ENV_NAME: ${{ matrix.env }}
          # SecureString用（環境ごとのGitHub Secretsから取得）
          SSM__DB__PASSWORD: ${{ secrets.SSM__DB__PASSWORD }}
          SSM__API__SECRET_KEY: ${{ secrets.SSM__API__SECRET_KEY }}
        run: |
          cd .github/scripts
          python update_aws_params.py

parameters:
  # 新しいパラメータを追加
  - key: feature/enable_payment_v2
    description: "新決済システムの有効化"
    environment_values:
      dev:  "true"
      stg:  "false"
      prod:  "false"

- key: payment/api_key
  description: "決済APIキー"
  type: "SecureString"

Secret名: SSM__PAYMENT__API_KEY
値: （環境ごとに異なる実際の値）

env:
  SSM__PAYMENT__API_KEY: ${{ secrets.SSM__PAYMENT__API_KEY }}