Recently on Feb 22, 2024 AWS has launched new capability to share Parameters in System Manager across the AWS accounts.
AWS Systems Manager’s Parameter Store is a tool that helps one to safely store configuration information. Now, it lets us share more advanced configuration details with other AWS accounts. This makes it easier to manage all your configuration data from one central location.
Many customers have work spread across different AWS accounts, all relying on the same configuration data. With this update, you can avoid the hassle of copying and syncing data manually. Instead, you can share parameters with other accounts that need access, creating a single, reliable source for all your configuration data.
In this blog post, I will guide you through the process of sharing AWS System Parameters with another AWS account. Here are the steps to setup how to create and share Parameter:
- First of all let’s create a new Parameter in Parameter Store, click on ‘Create parameter’ button
- Provide Name and ensure to select Advanced Tier. Please note cross account Parameter share is only possible if you select Tier as Advanced
- For now lets consider type as String and value as t3.medium
- Click on ‘Create parameter’ button
- The parameter is created now
- Click on the parameter and select ‘Sharing’ tab and click on Share button.
- This will open new window for ‘Resource Access Manager’
- Click on ‘Create resource share’
- Enter Name, in Resources drop down select ‘Parameter Store Advanced Parameters’
- This will show you Parameters that you have created in this account, select parameter which you want to share with other accounts. In our case it would be InstanceType and then select Next
- Choose Permissions for sharing parameters either AWS Managed or Customer Managed, for this demo lets choose AWS Managed Permission
- Let’s select AWS account with whom you want to share Parameter. In our case we choose to share it with account named ‘AI-POC’
- Click next and click ‘Create resource share’
- Now your resource share has been created
Next let’s see how to access Parameter created above:
- Now lets login to consumer AWS account in our case it would be ‘AI-POC’
- Go to RAM (Resource Access Manager) and click on ‘Resource shares’ under ‘Shared with me’
- You would be able to see Parameter which was shared from earlier account.
- Consumer account can access shared parameters using the AWS command line tools, and AWS SDKs.
- Here is the CLI command –> aws ssm get-parameter –name arn:aws:ssm:us-east-1:<ProducerAWSAccount#>:parameter/InstanceType
- Here is the output of the command, you would able to access Parameter value.
Important Notes..
- Your consumer accounts receive read-only access to you shared parameters
- The consumer can’t update or delete the parameter
- The consumer can’t share the parameter with a third account
- To share a parameter with your organization or an organizational unit in AWS Organizations, you must enable sharing with AWS Organizations
- To share a SecureString parameter, it must be encrypted with a customer managed key, and you must share the key separately through AWS Key Management Service
I hope you find this blog post enjoyable and that it provides you with a high-level understanding of how cross-account parameter sharing operates. If you appreciate this post, please consider sharing it with others 🙂