Parameters
The Parameters utility provides high-level functionality to retrieve one or multiple parameter values from AWS Systems Manager Parameter Store, AWS Secrets Manager, Amazon DynamoDB, or AWS AppConfig. We also provide extensibility to bring your own providers.
Key features¶
- Retrieve one or multiple parameters from the underlying provider
- Cache parameter values for a given amount of time (defaults to 5 seconds)
- Transform parameter values from JSON or base 64 encoded strings
- Bring your own parameter store provider
Installation¶
Powertools for AWS Lambda (.NET) are available as NuGet packages. You can install the packages from NuGet Gallery or from Visual Studio editor by searching AWS.Lambda.Powertools*
to see various utilities available.
-
AWS.Lambda.Powertools.Parameters:
dotnet nuget add AWS.Lambda.Powertools.Parameters
IAM Permissions
This utility requires additional permissions to work as expected. See the table below:
Provider | Function/Method | IAM Permission |
---|---|---|
SSM Parameter Store | SsmProvider.Get(string) SsmProvider.Get<T>(string) |
ssm:GetParameter |
SSM Parameter Store | SsmProvider.GetMultiple(string) SsmProvider.GetMultiple<T>(string) |
ssm:GetParametersByPath |
SSM Parameter Store | If using WithDecryption() option |
You must add an additional permission kms:Decrypt |
Secrets Manager | SecretsProvider.Get(string) SecretsProvider.Get<T>(string) |
secretsmanager:GetSecretValue |
DynamoDB | DynamoDBProvider.Get(string) DynamoDBProvider.Get<T>(string) |
dynamodb:GetItem |
DynamoDB | DynamoDBProvider.GetMultiple(string) DynamoDBProvider.GetMultiple<T>(string) |
dynamodb:Query |
App Config | AppConfigProvider.Get() |
appconfig:StartConfigurationSession appconfig:GetLatestConfiguration |
SSM Parameter Store¶
You can retrieve a single parameter using SsmProvider.Get()
and pass the key of the parameter.
For multiple parameters, you can use SsmProvider.GetMultiple()
and pass the path to retrieve them all.
Alternatively, you can retrieve the instance of provider and configure its underlying SDK client, in order to get data from other regions or use specific credentials.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 |
|
Additional arguments¶
The AWS Systems Manager Parameter Store provider supports two additional arguments for the Get()
and GetMultiple()
methods:
Option | Default | Description |
---|---|---|
WithDecryption() | False |
Will automatically decrypt the parameter. |
Recursive() | False |
For GetMultiple() only, will fetch all parameter values recursively based on a path prefix. |
You can create SecureString
parameters, which are parameters that have a plaintext parameter name and an encrypted parameter value. If you don't use the WithDecryption()
option, you will get an encrypted value. Read here about best practices using KMS to secure your parameters.
Example:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 |
|
Secrets Manager¶
For secrets stored in Secrets Manager, use SecretsProvider
.
Alternatively, you can retrieve the instance of provider and configure its underlying SDK client, in order to get data from other regions or use specific credentials.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
|
DynamoDB Provider¶
For parameters stored in a DynamoDB table, use DynamoDBProvider
.
DynamoDB table structure for single parameters
For single parameters, you must use id
as the partition key for that table.
Example
DynamoDB table with id
partition key and value
as attribute
id | value |
---|---|
my-parameter | my-value |
With this table, DynamoDBProvider.Get("my-param")
will return my-value
.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
|
DynamoDB table structure for multiple values parameters
You can retrieve multiple parameters sharing the same id
by having a sort key named sk
.
Example
DynamoDB table with id
primary key, sk
as sort keyand
value` as attribute
id | sk | value |
---|---|---|
my-hash-key | param-a | my-value-a |
my-hash-key | param-b | my-value-b |
my-hash-key | param-c | my-value-c |
With this table, DynamoDBProvider.GetMultiple("my-hash-key")
will return a dictionary response in the shape of sk:value
.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
|
1 2 3 4 5 |
|
Customizing DynamoDBProvider
DynamoDB provider can be customized at initialization to match your table structure:
Parameter | Mandatory | Default | Description |
---|---|---|---|
table_name | Yes | (N/A) | Name of the DynamoDB table containing the parameter values. |
key_attr | No | id |
Hash key for the DynamoDB table. |
sort_attr | No | sk |
Range key for the DynamoDB table. You don't need to set this if you don't use the GetMultiple() method. |
value_attr | No | value |
Name of the attribute containing the parameter value. |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
|
App Configurations¶
For application configurations in AWS AppConfig, use AppConfigProvider
.
Alternatively, you can retrieve the instance of provider and configure its underlying SDK client, in order to get data from other regions or use specific credentials.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
|
Using AWS AppConfig Feature Flags
Feature flagging is a powerful tool that allows safely pushing out new features in a measured and usually gradual way. AppConfig provider offers helper methods to make it easier to work with feature flags.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 |
|
Advanced configuration¶
Caching¶
By default, all parameters and their corresponding values are cached for 5 seconds.
You can customize this default value using DefaultMaxAge
. You can also customize this value for each parameter using
WithMaxAge
.
If you'd like to always ensure you fetch the latest parameter from the store regardless if already available in cache, use ForceFetch
.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
|
Transform values¶
Parameter values can be transformed using WithTransformation()
. Base64 and JSON transformations are provided.
For more complex transformation, you need to specify how to deserialize by writing your own transfomer.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 |
|
Partial transform failures with GetMultiple()
¶
If you use Transformation
with GetMultiple()
, you can have a single malformed parameter value. To prevent failing the entire request, the method will return a Null
value for the parameters that failed to transform.
You can override this by using RaiseTransformationError()
. If you do so, a single transform error will raise a TransformationException
exception.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
|
Auto-transform values on suffix¶
If you use Transformation
with GetMultiple()
, you might want to retrieve and transform parameters encoded in different formats.
You can do this with a single request by using Transformation.Auto
. This will instruct any Parameter to to infer its type based on the suffix and transform it accordingly.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
|
For example, if you have two parameters with the following suffixes .json
and .binary
:
Parameter name | Parameter value |
---|---|
/param/a.json | [some encoded value] |
/param/a.binary | [some encoded value] |
The return of GetMultiple()
with Transformation.Auto
will be a dictionary like:
1 2 3 4 |
|
Write your own Transformer¶
You can write your own transformer, by implementing the ITransformer
interface and the Transform<T>(string)
method.
For example, if you wish to deserialize XML into an object.
1 2 3 4 5 6 7 8 9 10 11 12 |
|
1 2 3 4 |
|
1 2 3 4 5 6 7 8 9 |
|
Fluent API¶
To simplify the use of the library, you can chain all method calls before a get.
1 2 3 4 5 6 |
|
Create your own provider¶
You can create your own custom parameter provider by inheriting the BaseProvider
class and implementing the
String getValue(String key)
method to retrieve data from your underlying store. All transformation and caching logic is handled by the get() methods in the base class.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 |
|
1 2 3 4 5 6 |
|