Documentation
¶
Overview ¶
Package ssm is doze-aws's local Systems Manager Parameter Store: parameter hierarchies with versions, labels, and history; String, StringList, and SecureString types. SecureString values are genuinely encrypted at rest with a per-data-dir AES-256-GCM key that the service manages itself (a KMS KeyId is recorded and returned cosmetically) — so SSM works with or without the kms service enabled.
Only the Parameter Store slice of SSM's huge API is meaningful locally. Fleet management (documents, Run Command, sessions, patching, inventory, OpsCenter, maintenance windows) needs managed instances that don't exist here; those operations answer a clean UnsupportedOperationException.
See docs/api-support/ssm.md for the operation-by-operation support table.
Index ¶
- type Options
- type Parameter
- type Server
- type Store
- func (s *Store) ByPath(path string, recursive bool) ([]Parameter, error)
- func (s *Store) Delete(name string) *awshttp.APIError
- func (s *Store) Get(selector string, decrypt bool) (*Parameter, *Version, string, *awshttp.APIError)
- func (s *Store) Label(name string, version int64, labels []string) (attached []string, aerr *awshttp.APIError)
- func (s *Store) List() ([]Parameter, error)
- func (s *Store) Put(name, ptype, value, keyID, description, dataType, tier, policies string, ...) (int64, *awshttp.APIError)
- func (s *Store) SweepExpired()
- func (s *Store) Tags(name string) (map[string]string, *awshttp.APIError)
- func (s *Store) Unlabel(name string, version int64, labels []string) (removed []string, aerr *awshttp.APIError)
- func (s *Store) UpdateTags(name string, add map[string]string, removeKeys []string) *awshttp.APIError
- type Version
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Options ¶
type Options struct {
// DataDir holds the bbolt store (ssm.bolt) and the SecureString key
// (ssm.key). Required.
DataDir string
// Peers is accepted for constructor uniformity; SSM calls no siblings.
Peers peers.Directory
// Logf receives log lines; nil discards.
Logf func(format string, args ...any)
// Clock overrides time.Now in tests.
Clock func() time.Time
}
Options configures the service.
type Parameter ¶
type Parameter struct {
Name string `json:"name"`
Type string `json:"type"` // String | StringList | SecureString
KeyID string `json:"key_id,omitempty"`
Description string `json:"description,omitempty"`
DataType string `json:"data_type,omitempty"` // default "text"
Tier string `json:"tier,omitempty"` // Standard | Advanced (cosmetic)
Policies string `json:"policies,omitempty"` // raw policy JSON round-trip
ExpiresAt int64 `json:"expires_at,omitempty"` // parsed Expiration policy, unix seconds
Tags map[string]string `json:"tags,omitempty"`
Versions []Version `json:"versions"` // ascending version order
}
Parameter is one parameter with its full version history.
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
Server is the SSM service: an http.Handler speaking AWS JSON 1.1, and an io.Closer that stops the janitor and closes the store.
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store is the bbolt-backed parameter store plus the SecureString sealer.
func (*Store) Get ¶
func (s *Store) Get(selector string, decrypt bool) (*Parameter, *Version, string, *awshttp.APIError)
Get resolves a selector: "name", "name:version", or "name:label".
func (*Store) Label ¶
func (s *Store) Label(name string, version int64, labels []string) (attached []string, aerr *awshttp.APIError)
Label attaches labels to a version, moving each label from any version that had it (SSM semantics: a label names at most one version).
func (*Store) Put ¶
func (s *Store) Put(name, ptype, value, keyID, description, dataType, tier, policies string, expiresAt int64, tags map[string]string, overwrite bool) (int64, *awshttp.APIError)
Put creates or overwrites a parameter, bumping the version.
func (*Store) SweepExpired ¶
func (s *Store) SweepExpired()
SweepExpired deletes parameters whose Expiration policy has passed.
Source Files