Feature request: Setting Parameters and Secrets

[stephenbawks]

Use case

The parameters module currently only allows users to read secrets and parameters from the Secret and Parameter Store. I would like to extend the parameters module to allow users to write secrets and parameters back to the stores. This would make it easier for users to update values that are stored in the Secret Store, without having to create their own boto3 client.

Solution/User Experience

The parameters module provides a convenient and easy-to-use way to read values from the Secret and Parameter Store. It eliminates the need to set up your own session, making it a more streamlined and efficient process. I would like to replicate these features by adding the ability to write values back to the stores.

Alternative solutions

No response

Acknowledgment

• This feature request meets Powertools for AWS Lambda (Python) Tenets
• Should this be considered in other Powertools for AWS Lambda languages? i.e. Java, TypeScript, and .NET

[heitorlessa]

hey @stephenbawks thanks for another nice idea! Got any ideas on what the experience could look like?

Like this?

provider = SSMProvider()
provider.set(param_or_secret_name, value, **sdk_options)

SSM has quite a few options so I'd start by defining what are the most common options so we can have defaults or infer to keep it simple: https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/ssm/client/put_parameter.html

[stephenbawks]

Yah I started on this actually this morning. Might commit some early stuff and get some initial feedback since the parameter code is quite complex like you are saying with so many options.
@heitorlessa

[leandrodamascena]

Hei @heitorlessa and @stephenbawks! Is this issue related to the PR #2858?

I really like this idea because we can make it easy to set and update secrets and parameters. Should we include AppConfig also?

Heitor's suggestion:

hey @stephenbawks thanks for another nice idea! Got any ideas on what the experience could look like?

Like this?

provider = SSMProvider()
provider.set(param_or_secret_name, value, **sdk_options)

I like this experience, but we need to add high-level functions also, right?

So, lets see if we can work to get it merged soon.

Thanks

[thiagoamaciel]

I'd love this feature also. I have a use case that I need to update a token every hour. Had to do this using boto3, but the user exp should improve a lot calling a function like Heitor mentioned.

Willing to help in case you guys need it.

[leandrodamascena]

Hey everyone! I'm writing an RFC to define how we implement this. At first glance, it looks like we only need one method to define a new parameter/secret, but there are things to discuss before implementing this.

• What is the best developer experience in this case? Create a single set() method for create and update or create() and update() methods?
• If an parameter/secret already exists, we replace the value? We will add a new Optinal parameter to force overwrite?
• Do we need to add support to create profiles/config in AppConfig?
• If a customer creates/updates a new parameter/secret, we cache that value the same way it does when using get()?

Once I have the RFC created I will update this issue with the link.

Thank you.