Assigning parameter policies
Parameter policies help you manage a growing set of parameters by enabling you to
assign specific criteria to a parameter such as an expiration date or time
to live. Parameter policies are especially helpful in forcing you to
update or delete passwords and configuration data stored in Parameter Store, a capability
of AWS Systems Manager. Parameter Store offers the following types of policies:
Expiration, ExpirationNotification, and
NoChangeNotification.
To implement password rotation lifecycles, use AWS Secrets Manager. You can rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle using Secrets Manager. For more information, see What is AWS Secrets Manager? in the AWS Secrets Manager User Guide.
Parameter Store enforces parameter policies by using asynchronous, periodic scans. After you create a policy, you don't need to perform additional actions to enforce the policy. Parameter Store independently performs the action defined by the policy according to the criteria you specified.
Parameter policies are available for parameters that use the advanced parameters tier. For more information, see Managing parameter tiers.
A parameter policy is a JSON array, as shown in the following table. You can assign a policy when you create a new advanced parameter, or you can apply a policy by updating a parameter. Parameter Store supports the following types of parameter policies.
| Policy | Details | Examples |
|---|---|---|
|
Expiration |
This policy deletes the parameter. You can specify a specific
date and time by using either the This example uses the |
|
|
ExpirationNotification |
This policy triggers an event in Amazon EventBridge (EventBridge) that notifies you about the expiration. By using this policy, you can receive notifications before the expiration time is reached, in units of days or hours. |
|
|
NoChangeNotification |
This policy triggers an event in EventBridge if a parameter has not been modified for a specified period of time. This policy type is useful when, for example, a password needs to be changed within a period of time. This policy determines when to send a notification by reading
the |
|
You can assign multiple policies to a parameter. For example, you can assign
Expiration and ExpirationNotification policies so that
the system triggers an EventBridge event to notify you about the impending deletion
of a
parameter. You can assign a maximum of ten (10) policies to a parameter.
The following example shows a PutParameter API request that assigns four policies to a new
SecureString parameter named ProdDB3.
PutParameterRequest { "Name":"ProdDB3", "Description":"Parameter with policies", "Value":"P@ssW*rd21", "Type":"SecureString", "Overwrite":"True", "Policies":[ { "Type":"Expiration", "Version":"1.0", "Attributes":{ "Timestamp":"2018-12-02T21:34:33.000Z" } }, { "Type":"ExpirationNotification", "Version":"1.0", "Attributes":{ "Before":"30", "Unit":"Days" } }, { "Type":"ExpirationNotification", "Version":"1.0", "Attributes":{ "Before":"15", "Unit":"Days" } }, { "Type":"NoChangeNotification", "Version":"1.0", "Attributes":{ "After":"20", "Unit":"Days" } } ] }
Adding policies to an existing parameter
This section includes information about how to add policies to an existing parameter by using the AWS Systems Manager console, the AWS Command Line Interface (AWS CLI), and AWS Tools for Windows PowerShell . For information about how to create a new parameter that includes policies, see Creating Systems Manager parameters.
Topics
Add policies to an existing parameter (console)
Use the following procedure to add policies to an existing parameter by using the Systems Manager console.
To add policies to an existing parameter
-
Open the AWS Systems Manager console at https://console.aws.amazon.com/systems-manager/
. -
In the navigation pane, choose Parameter Store.
-or-
If the AWS Systems Manager home page opens first, choose the menu icon (
) to open the
navigation pane, and then choose Parameter Store.
-
Choose the option next to the parameter that you want to update to include policies, and then choose Edit.
-
Choose Advanced.
-
(Optional) In the Parameter policies section, choose Enabled. You can specify an expiration date and one or more notification policies for this parameter.
-
Choose Save changes.
-
Parameter Store preserves policies on a parameter until you either overwrite the policies with new policies or remove the policies.
-
To remove all policies from an existing parameter, edit the parameter and apply an empty policy by using brackets and curly braces, as follows:
[{}] -
If you add a new policy to a parameter that already has policies, then Systems Manager overwrites the policies attached to the parameter. The existing policies are deleted. If you want to add a new policy to a parameter that already has one or more policies, then you must copy and paste the original policies, type the new policy, and then save your changes.
Add policies to an existing parameter (AWS CLI)
Use the following procedure to add policies to an existing parameter by using the AWS CLI.
To add policies to an existing parameter
-
Install and configure the AWS Command Line Interface (AWS CLI), if you have not already.
For information, see Install or upgrade AWS command line tools.
-
Run the following command to add policies to an existing parameter.
Here is an example that includes an expiration policy that deletes the parameter after 15 days. The example also includes a notification policy that generates an EventBridge event five (5) days before the parameter is deleted. Last, it includes a
NoChangeNotificationpolicy if no changes are made to this parameter after 60 days. The example uses an obfuscated name (3l3vat3131) for a password and an AWS Key Management Service AWS KMS key. For more information about AWS KMS keys, see AWS Key Management Service Concepts in the AWS Key Management Service Developer Guide. -
Run the following command to verify the details of the parameter.
-
Parameter Store retains policies for a parameter until you either overwrite the policies with new policies or remove the policies.
-
To remove all policies from an existing parameter, edit the parameter and apply an empty policy of brackets and curly braces. For example:
-
If you add a new policy to a parameter that already has policies, then Systems Manager overwrites the policies attached to the parameter. The existing policies are deleted. If you want to add a new policy to a parameter that already has one or more policies, then you must copy and paste the original policies, type the new policy, and then save your changes.
Add policies to an existing parameter (Tools for Windows PowerShell)
Use the following procedure to add policies to an existing parameter by using Tools for Windows PowerShell.
To add policies to an existing parameter
-
Open Tools for Windows PowerShell and run the following command to specify your credentials. You must either have administrator permissions in Amazon Elastic Compute Cloud (Amazon EC2), or you must have been granted the appropriate permission in AWS Identity and Access Management (IAM). For more information, see Systems Manager prerequisites.
Set-AWSCredentials –AccessKeyaccess-key-name–SecretKeysecret-key-name -
Run the following command to set the Region for your PowerShell session. The example uses the US East (Ohio) Region (us-east-2).
Set-DefaultAWSRegion -Region us-east-2 -
Run the following command to add policies to an existing parameter.
Write-SSMParameter -Name "parameter-name" -Value "parameter-value" -Type "parameter-type" -Policies "[{policies-enclosed-in-brackets-and-curly-braces}]" -OverwriteHere is an example that includes an expiration policy that deletes the parameter at midnight (GMT) on May 13, 2020. The example also includes a notification policy that generates an EventBridge event five (5) days before the parameter is deleted. Last, it includes a
NoChangeNotificationpolicy if no changes are made to this parameter after 60 days. The example uses an obfuscated name (3l3vat3131) for a password and an AWS managed key.Write-SSMParameter -Name "/Finance/Payroll/3l3vat3131" -Value "P@sSwW)rd" -Type "SecureString" -Policies "[{\"Type\":\"Expiration\",\"Version\":\"1.0\",\"Attributes\":{\"Timestamp\":\"2018-05-13T00:00:00.000Z\"}},{\"Type\":\"ExpirationNotification\",\"Version\":\"1.0\",\"Attributes\":{\"Before\":\"5\",\"Unit\":\"Days\"}},{\"Type\":\"NoChangeNotification\",\"Version\":\"1.0\",\"Attributes\":{\"After\":\"60\",\"Unit\":\"Days\"}}]" -Overwrite -
Run the following command to verify the details of the parameter.
(Get-SSMParameterValue -Name "parameter-name-you-specified").Parameters
-
Parameter Store preserves policies on a parameter until you either overwrite the policies with new policies or remove the policies.
-
To remove all policies from an existing parameter, edit the parameter and apply an empty policy of brackets and curly braces. For example:
Write-SSMParameter -Name "parameter-name" -Value "parameter-value" -Type "parameter-type" -Policies "[{}]" -
If you add a new policy to a parameter that already has policies, then Systems Manager overwrites the policies attached to the parameter. The existing policies are deleted. If you want to add a new policy to a parameter that already has one or more policies, then you must copy and paste the original policies, type the new policy, and then save your changes.
