chamber VS hiera-eyaml

Chamber takes an opinionated view on AWS Parameter store as compared to ssmsh

Building on this I’ve found https://github.com/segmentio/chamber to be super useful

For secrets, the PaaS platform (Github Actions, Fly.io, etc.) I usually use has a method that works with environment variables. If I need something custom on AWS, then I use Chamber backed by AWS KMS.

We use Chamber (https://github.com/segmentio/chamber) to do this for us. Bring it into your image and use the environment variables as necessary. Some applications support using environment variables natively, you might need to add a script to write them into your config files.

You can take a look at some code I wrote a while back to do this if you want examples https://github.com/segmentio/chamber/blob/master/store/ssmstore.go .

We use AWS Parameter Store and segmentio/chamber.

https://github.com/segmentio/chamber is nice with parameter store, ive used it in the past.

Use Chamber.

For interacting with SSM, I would recommend using https://github.com/segmentio/chamber. You could add something to your user-data script that uses chamber to load a config file (chamber export is one way to do it) from SSM on startup. You could also use Systems Manager to enable you to do a "hot reload" of sorts by sending a command to your server to run the chamber command and restart your application.

Another way is to use the Hiera eyaml backend: https://github.com/voxpupuli/hiera-eyaml. With eyaml, you swap out the plaintext secrets in your Hiera for encrypted strings that are decrypted during catalog compilation.