Support for AWS Systems Manager Parameter Store

[theowenyoung]

Add support for AWS Parameter Store as a cloud secret storage provider alongside the existing aws-sm (Secrets Manager).

Motivation

AWS Parameter Store is widely used and offers:

• Cost-effective: Standard parameters are free
• Simple: Great for configuration and non-rotating secrets
• Hierarchical: Path-based organization (/myapp/prod/database/url)

Proposed Configuration

[providers.aws-ps]
type = "aws-ps"
region = "us-east-1"
prefix = "/myapp/prod/"

[secrets.DATABASE_URL]
provider = "aws-ps"
value = "database/url"  # Resolves to /myapp/prod/database/url

[jdx]

This has been implemented and is available in PR #126: #126 🎉

Configuration

[providers.aws-ps]
type = "aws-ps"
region = "us-east-1"
prefix = "/myapp/prod/"  # optional

[secrets]
DATABASE_URL = { provider = "aws-ps", value = "database/url" }  # Resolves to /myapp/prod/database/url

Features

• Hierarchical paths: Full support for Parameter Store path-based organization (/myapp/prod/database/url)
• SecureString support: Automatically decrypts SecureString parameters
• Batch retrieval: Efficient batch API support (up to 10 parameters per call)
• Read and write: Can both retrieve and store secrets (fnox set creates SecureString parameters)
• Prefix support: Optional prefix for namespacing parameters

Requirements

• AWS credentials configured
• IAM permissions: ssm:GetParameter, ssm:GetParameters, ssm:DescribeParameters, and ssm:PutParameter for writing

Usage

# Add the provider
fnox provider add ps aws-ps

# Store a secret
fnox set MY_SECRET "my-value" --provider ps

# Retrieve a secret
fnox get MY_SECRET

# Use in shell commands
fnox exec -- ./my-app

This matches the proposed configuration in the issue. Thanks for the feature request!

[theowenyoung]

Amazing, thanks for the quick implementation! This is perfect. 🙏