Passing a Parameter List Into A Container That Runs an AWS Deployment
ACM.392 Passing in a parameter value for an AWS SSM Parameter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
⚙️ Check out my series on Automating Cybersecurity Metrics | Code.
🔒 Related Stories: Container Security | AWS Security
💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In the last I explained how I’m going to production and non-production environments and repositories in my organization. Repositories are one of the keys to governance and security in your cloud account.
Before I proceed with creating accounts, I need to clean up my Systems Manager Parameter code. I’m also not sure I need all my parameters but for now I’m leaving them.
The issue is that the script was initially run by root but now it’s run by my rootadminrole in a container. The script in the container cannot be interactive so I have to pass some values into the container instead.
I wrote about trying to store those parameters in an SSM parameter, but I’d have to manually create a parameter to automate the creation of a parameter and that doesn’t really make sense. For these simple scripts I want to pass in the parameter, but how should I do it?
ry I could pass in domain=something the domain parameter and org=something for the org parameter but what’s wrong with that picture? Our parameter list is going to change every time and become very messy. I want a standard input list, so the last argument passed into the container is going to be an optional single argument which is a list of parameters.

Domain SSM parameter
I’m removing dynamic SSM parameters as they pose the problems mentioned in this post:
I move the parameters out of the organization deploy script put the org and domain parameters into their own files. As I mentioned I’m not sure I still need the environment parameter but it’s easy to add if needed.
I request the values in the local test script and pass it into the container as parameters in this format:
[name=value,name=value,name=value]
I added some validation when the parameter is retrieved in job/run.sh but could be better. I’m not going to even post it here.
I added a common function to parse the value of the parameter:

I move over my parameter_functions.sh file from the POC codebase and adjust it as explained here:
Now I can call my generic functions to get and set a parameter in my deploy scripts. Here’s an example for my email domain:

That’s it. Now I can create parameters easily with the container that assumes a role with MFA.
Other stories on SSM Parameter store if you missed them:
Next I’ll start building out my new organization structure.
Follow for updates.
Teri Radichel | © 2nd Sight Lab 2023
About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight LabNeed Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for PresentationFollow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab
