cfn-secret-provider VS chamber

that in combination with a custom secret provider we created (https://github.com/binxio/cfn-secret-provider) means all secrets are stored properly on the tenant itself and not in config files.

If you are instrumenting secrets generation and versioning in your CFN templates into param. store, you can save yourself the cost of SM. Not exactly the same, but very close. https://github.com/binxio/cfn-secret-provider

Chamber takes an opinionated view on AWS Parameter store as compared to ssmsh

Building on this I’ve found https://github.com/segmentio/chamber to be super useful

For secrets, the PaaS platform (Github Actions, Fly.io, etc.) I usually use has a method that works with environment variables. If I need something custom on AWS, then I use Chamber backed by AWS KMS.

We use Chamber (https://github.com/segmentio/chamber) to do this for us. Bring it into your image and use the environment variables as necessary. Some applications support using environment variables natively, you might need to add a script to write them into your config files.

You can take a look at some code I wrote a while back to do this if you want examples https://github.com/segmentio/chamber/blob/master/store/ssmstore.go .

We use AWS Parameter Store and segmentio/chamber.

https://github.com/segmentio/chamber is nice with parameter store, ive used it in the past.

Use Chamber.

For interacting with SSM, I would recommend using https://github.com/segmentio/chamber. You could add something to your user-data script that uses chamber to load a config file (chamber export is one way to do it) from SSM on startup. You could also use Systems Manager to enable you to do a "hot reload" of sorts by sending a command to your server to run the chamber command and restart your application.