How to access ssm variables

Serverless Framework
, , ,
1

I’m writing a function on my local device and want to deploy it securely to AWS Lambda. I’ve configured a serverless.yml file and have defined environment variables for my function.

I’ve defined the function as such in serverless.yml:

functions:
  handler:
    handler: handler.run
    description: A scheduled task that sends reminders to users who haven't scanned in 2 or more days
    environment:
      #Refer to https://www.serverless.com/blog/aws-secrets-management/
      DOCCLIENT_ACCESSKEYID: ${ssm:/accessKeyId~true}
      DOCCLIENT_SECRETACCESSKEY: ${ssm:/secretAccessKey~true}
    events: 
      -schedule: cron(0 10 * * *)

I’ve also defined in AWS Systems Manager two parameters: accessKeyId & secretAccessKey.
However I’m getting this error when running serverless deploy in my terminal.

Cannot resolve serverless.yml: Variables resolution errored with:
  - Cannot resolve variable at "functions.handler.environment.DOCCLIENT_ACCESSKEYID": Parameter name: can't be prefixed with "ssm" (case-insensitive). If formed as a path, it can consist of sub-paths divided by slash symbol; each sub-path can be formed as a mix of letters, numbers and the following 3 symbols .-_,
  - Cannot resolve variable at "functions.handler.environment.DOCCLIENT_SECRETACCESSKEY": Parameter name: can't be prefixed with "ssm" (case-insensitive). If formed as a path, it can consist of sub-paths divided by slash symbol; each sub-path can be formed as a mix of letters, numbers and the following 3 symbols .-_

Please help :slight_smile:

2

Hi @ sjschweber I am also facing the same issue. Did you find the solution?

3

Are you store these as strings or secure strings in SSM?

4

Anyone’s who still faces this issue you do not to pass ~true to decrypt your SecureString parameter. The Framework does it by default is you do not want it decrypted pass ssm(noDecrypt) to not decrypt it.
Reference: Serverless Framework - Variables - AWS SSM & Secrets Manager