Skip to content

Commit fd41882

Browse files
committed
Respect POWERTOOLS_PARAMETERS_SSM_DECRYPT environment variable when getting multiple parameters.
When getting multiple ssm parameters by path, the `POWERTOOLS_PARAMETERS_SSM_DECRYPT` environment variable should be respected as to whether to automatically decrypt the values, as is with the single `get`.
1 parent e37a6aa commit fd41882

File tree

2 files changed

+54
-1
lines changed

2 files changed

+54
-1
lines changed

aws_lambda_powertools/utilities/parameters/ssm.py

+7-1
Original file line numberDiff line numberDiff line change
@@ -188,7 +188,7 @@ def _get(self, name: str, decrypt: bool = False, **sdk_options) -> str:
188188

189189
return self.client.get_parameter(**sdk_options)["Parameter"]["Value"]
190190

191-
def _get_multiple(self, path: str, decrypt: bool = False, recursive: bool = False, **sdk_options) -> Dict[str, str]:
191+
def _get_multiple(self, path: str, decrypt: Optional[bool] = None, recursive: bool = False, **sdk_options) -> Dict[str, str]:
192192
"""
193193
Retrieve multiple parameter values from AWS Systems Manager Parameter Store
194194
@@ -204,6 +204,12 @@ def _get_multiple(self, path: str, decrypt: bool = False, recursive: bool = Fals
204204
Dictionary of options that will be passed to the Parameter Store get_parameters_by_path API call
205205
"""
206206

207+
# If decrypt is not set, resolve it from the environment variable, defaulting to False
208+
decrypt = resolve_truthy_env_var_choice(
209+
env=os.getenv(constants.PARAMETERS_SSM_DECRYPT_ENV, "false"),
210+
choice=decrypt,
211+
)
212+
207213
# Explicit arguments will take precedence over keyword arguments
208214
sdk_options["Path"] = path
209215
sdk_options["WithDecryption"] = decrypt

tests/functional/test_utilities_parameters.py

+47
Original file line numberDiff line numberDiff line change
@@ -960,6 +960,53 @@ def test_ssm_provider_get_sdk_options_overwrite(mock_name, mock_value, mock_vers
960960
stubber.deactivate()
961961

962962

963+
def test_ssm_provider_get_multiple_with_decrypt_environment_variable(monkeypatch, mock_name, mock_value, mock_version, config):
964+
"""
965+
Test SSMProvider.get_multiple() with decrypt value replaced by environment variable
966+
"""
967+
968+
# Setting environment variable to override the default value
969+
monkeypatch.setenv("POWERTOOLS_PARAMETERS_SSM_DECRYPT", "true")
970+
971+
mock_param_names = ["A", "B", "C"]
972+
973+
# Create a new provider
974+
provider = parameters.SSMProvider(config=config)
975+
976+
# Stub the boto3 client
977+
stubber = stub.Stubber(provider.client)
978+
response = {
979+
"Parameters": [
980+
{
981+
"Name": f"{mock_name}/{name}",
982+
"Type": "String",
983+
"Value": f"{mock_value}/{name}",
984+
"Version": mock_version,
985+
"Selector": f"{mock_name}/{name}:{mock_version}",
986+
"SourceResult": "string",
987+
"LastModifiedDate": datetime(2015, 1, 1),
988+
"ARN": f"arn:aws:ssm:us-east-2:111122223333:parameter/{mock_name}/{name}",
989+
}
990+
for name in mock_param_names
991+
],
992+
}
993+
expected_params = {"Path": mock_name, "Recursive": False, "WithDecryption": True}
994+
stubber.add_response("get_parameters_by_path", response, expected_params)
995+
stubber.activate()
996+
997+
try:
998+
values = provider.get_multiple(mock_name)
999+
1000+
stubber.assert_no_pending_responses()
1001+
1002+
assert len(values) == len(mock_param_names)
1003+
for name in mock_param_names:
1004+
assert name in values
1005+
assert values[name] == f"{mock_value}/{name}"
1006+
finally:
1007+
stubber.deactivate()
1008+
1009+
9631010
def test_ssm_provider_get_multiple(mock_name, mock_value, mock_version, config):
9641011
"""
9651012
Test SSMProvider.get_multiple() with a non-cached path

0 commit comments

Comments
 (0)