# SSM SecureString decryption **URL:** \ **Category:** Serverless Framework\ **Created:** [September 21, 2017, 6:10am UTC](https://forum.serverless.com/t/ssm-securestring-decryption/2741 "2017-09-21T06:10:29Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![robertral](https://avatars.discourse-cdn.com/v4/letter/r/258eb7/32.png) [@robertral](https://forum.serverless.com/u/robertral)\ **Post date:** [September 21, 2017, 6:10am UTC](https://forum.serverless.com/t/ssm-securestring-decryption/2741/1 "2017-09-21T06:10:29Z")
Hi there, I’m trying to extract variables from SSM and for String type the `${sam:/path/to/param}` works perfectly, but I’m struggling trying to extract params from SSM that are of type SecureString. As per the SLS docs ([https://serverless.com/framework/docs/providers/aws/guide/variables/](https://serverless.com/framework/docs/providers/aws/guide/variables/)) I’m using `${ssm:/path/to/secureparam~true}` but it always returns _undefined_. I guess my question is, how does SLS know which KMS key to decrypt this with? I’m missing part of puzzle here. Any help wild be greatly appreciated. Thanks I’m using SLS 1.22.0 ---
**Author:** ![rowanu](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/rowanu/32/75_2.png) [@rowanu](https://forum.serverless.com/u/rowanu)\ **Post date:** [September 21, 2017, 10:40pm UTC](https://forum.serverless.com/t/ssm-securestring-decryption/2741/2 "2017-09-21T22:40:01Z")
A quick look at [the docs](http://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-paramstore-access.html) (because I haven’t used this functionality myself yet) suggests that the SSM service uses a KMS key with the alias `aws/ssm` (which is automatically created for you). This is a common pattern used by other KMS-backed encryption services (e.g. EBS, etc). I’m not sure if this is configurable, but presumably (again, untried) you could update the alias to point at the key you want it to use (rather than the one that was created by default). ---
**Author:** ![delprofundo](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/delprofundo/32/175_2.png) [@delprofundo](https://forum.serverless.com/u/delprofundo)\ **Post date:** [September 22, 2017, 11:13am UTC](https://forum.serverless.com/t/ssm-securestring-decryption/2741/3 "2017-09-22T11:13:56Z")
I’m working on ssm right now too but I can’t even deploy with it. did you need to add any configuration settings other than creating the secure strings? I get an error in a different part of my serverless.yml if the ssm: prefix is present). ---
**Author:** ![robertral](https://avatars.discourse-cdn.com/v4/letter/r/258eb7/32.png) [@robertral](https://forum.serverless.com/u/robertral)\ **Post date:** [September 25, 2017, 4:07am UTC](https://forum.serverless.com/t/ssm-securestring-decryption/2741/4 "2017-09-25T04:07:00Z")
Hi, thanks for the reply. You are right, I wasn’t using the correct alias. All works now. Thanks for your help @rowanu ---
**Author:** ![lorengordon](https://avatars.discourse-cdn.com/v4/letter/l/c37758/32.png) [@lorengordon](https://forum.serverless.com/u/lorengordon)\ **Post date:** [September 25, 2017, 8:17pm UTC](https://forum.serverless.com/t/ssm-securestring-decryption/2741/5 "2017-09-25T20:17:23Z")
@delprofundo What version of sls are you using? Support for the SSM syntax was added in v1.21.1. ---
**Author:** ![delprofundo](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/delprofundo/32/175_2.png) [@delprofundo](https://forum.serverless.com/u/delprofundo)\ **Post date:** [September 26, 2017, 12:02am UTC](https://forum.serverless.com/t/ssm-securestring-decryption/2741/6 "2017-09-26T00:02:10Z")
1.22.0 I’ve raised a case that has been referenced to yours. I think once I get ready to go to production for now I’ll pass the region in the cli arguments. ---
**Author:** ![yankeeinlondon](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/yankeeinlondon/32/244_2.png) [@yankeeinlondon](https://forum.serverless.com/u/yankeeinlondon)\ **Post date:** [August 15, 2018, 6:21am UTC](https://forum.serverless.com/t/ssm-securestring-decryption/2741/7 "2018-08-15T06:21:04Z")
@lorengordon I’m running into this issue now, can you share the syntax you used to get it to work? Also, did you use the automatic key or did you force it to use a specific key?