https://pulumi.com logo
Title
g

great-sunset-355

06/19/2021, 6:49 AM
Hi,does anyone know how can I resolve value from SSM parameter in pulumi? We have bunch of secrets stored in SSM and I do not want to move them out.
l

little-cartoon-10569

06/20/2021, 9:38 PM
If you don't want to use AWS SDK code, you can use `Parameter.get()`: https://www.pulumi.com/docs/reference/pkg/aws/ssm/parameter/#look-up
It might also be worth importing the Parameters and making them Pulumi-managed. Then you won't need the get.
However it also means that the values will be either stored in code, or stored in a Pulumi secrets provider like KMS, which means they're duplicated.
g

great-sunset-355

06/21/2021, 6:18 AM
Thanks, that's what I learned myself yesterday as well, I need to try it out. One more question about
<Resource>.Get
method (I'll probably test it myself) - but I wonder how expensive it is, I mean how many times does it call AWS API or if it's just once and then the value is cached in state file or so.
l

little-cartoon-10569

06/21/2021, 8:38 PM
Values are stored in the state file and marked read-only, so if you change them they don't show in the preview or up. I would imagine that they are fetched each time Pulumi is run.
They would be fetched only once. Some complex resources may required more than one API call to populate all the values, but I don't know of any like that..
g

great-sunset-355

06/21/2021, 10:37 PM
Thanks, that's what I was after. I was curious how many times the values are fetched. It makes sense they'd be fetched once at the start and then stored.
👍 1
l

little-cartoon-10569

06/21/2021, 10:48 PM
Note that if you
get()
the same resource in multiple stacks, then the API calls will be made once per stack.
But you can get the values in one stack and add them as exports, then get those exported values in another stack. This would avoid calling the API again.
g

great-sunset-355

06/21/2021, 11:04 PM
That's good to keep in mind, fortunately I do not need to call for many resources yet!