# How to access ssm variables

**URL:** <https://forum.serverless.com/t/how-to-access-ssm-variables/16799>\
**Category:** Serverless Framework\
**Tags:** aws, lambda, security, variables\
**Created:** [February 23, 2022, 11:17pm UTC](https://forum.serverless.com/t/how-to-access-ssm-variables/16799 "2022-02-23T23:17:01Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sjschweber](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/sjschweber/32/6643_2.png) [@sjschweber](https://forum.serverless.com/u/sjschweber)\
**Post date:** [February 23, 2022, 11:17pm UTC](https://forum.serverless.com/t/how-to-access-ssm-variables/16799/1 "2022-02-23T23:17:01Z")

</div>

I’m writing a function on my local device and want to deploy it securely to AWS Lambda. I’ve configured a serverless.yml file and have defined environment variables for my function.

I’ve defined the function as such in serverless.yml:

```auto
functions:
  handler:
    handler: handler.run
    description: A scheduled task that sends reminders to users who haven't scanned in 2 or more days
    environment:
      #Refer to https://www.serverless.com/blog/aws-secrets-management/
      DOCCLIENT_ACCESSKEYID: ${ssm:/accessKeyId~true}
      DOCCLIENT_SECRETACCESSKEY: ${ssm:/secretAccessKey~true}
    events: 
      -schedule: cron(0 10 * * *)

```

I’ve also defined in AWS Systems Manager two parameters: `accessKeyId` & `secretAccessKey`.  
However I’m getting this error when running `serverless deploy` in my terminal.

```auto
Cannot resolve serverless.yml: Variables resolution errored with:
  - Cannot resolve variable at "functions.handler.environment.DOCCLIENT_ACCESSKEYID": Parameter name: can't be prefixed with "ssm" (case-insensitive). If formed as a path, it can consist of sub-paths divided by slash symbol; each sub-path can be formed as a mix of letters, numbers and the following 3 symbols .-_,
  - Cannot resolve variable at "functions.handler.environment.DOCCLIENT_SECRETACCESSKEY": Parameter name: can't be prefixed with "ssm" (case-insensitive). If formed as a path, it can consist of sub-paths divided by slash symbol; each sub-path can be formed as a mix of letters, numbers and the following 3 symbols .-_

```

Please help 🙂

---

<div class="post-metadata">

**Author:** ![sathish5995](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/sathish5995/32/7244_2.png) [@sathish5995](https://forum.serverless.com/u/sathish5995)\
**Post date:** [December 24, 2022, 1:48am UTC](https://forum.serverless.com/t/how-to-access-ssm-variables/16799/2 "2022-12-24T01:48:50Z")

</div>

Hi @ [sjschweber](https://forum.serverless.com/u/sjschweber) I am also facing the same issue. Did you find the solution?

---

<div class="post-metadata">

**Author:** ![buggy](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/buggy/32/177_2.png) [@buggy](https://forum.serverless.com/u/buggy)\
**Post date:** [December 25, 2022, 9:15am UTC](https://forum.serverless.com/t/how-to-access-ssm-variables/16799/3 "2022-12-25T09:15:01Z")

</div>

Are you store these as strings or secure strings in SSM?

---

<div class="post-metadata">

**Author:** ![nabhanh](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/nabhanh/32/7974_2.png) [@nabhanh](https://forum.serverless.com/u/nabhanh)\
**Post date:** [July 8, 2024, 1:41pm UTC](https://forum.serverless.com/t/how-to-access-ssm-variables/16799/4 "2024-07-08T13:41:45Z")

</div>

Anyone’s who still faces this issue you do not to pass `~true` to decrypt your SecureString parameter. The Framework does it by default is you do not want it decrypted pass ssm(noDecrypt) to not decrypt it.  
Reference: [Serverless Framework - Variables - AWS SSM & Secrets Manager](https://www.serverless.com/framework/docs-guides-variables-ssm)