Age Key from SSM Parameter Store

addAgeKeyFromSsmParameter eliminates this exposure: the key stays in SSM Parameter Store and is fetched at deploy time by the Lambda itself, entirely in-memory during decryption.

The SSM parameter must be a SecureString encrypted with a KMS customer-managed key (CMK). Storing an age private key without envelope encryption is considered insecure, so a KMS key is a required argument.

Basic usage

import { Key } from 'aws-cdk-lib/aws-kms';
 
const cmk = Key.fromKeyArn(this, 'SsmCmk', 'arn:aws:kms:us-east-1:111122223333:key/…');
 
const provider = new SopsSyncProvider(this, 'SopsProvider');
provider.addAgeKeyFromSsmParameter('/sops/age/private-key', cmk);
 
const secret = new SopsSecret(this, 'MySecret', {
  sopsFilePath: 'secrets/encrypted.yaml',
  sopsProvider: provider,
});

The construct automatically grants the Lambda ssm:GetParameter on the parameter and kms:Decrypt on the CMK.

Using an IStringParameter reference

Pass an IStringParameter object instead of a plain string if you already have a CDK parameter reference:

import { Key } from 'aws-cdk-lib/aws-kms';
import { StringParameter } from 'aws-cdk-lib/aws-ssm';
 
const cmk = Key.fromKeyArn(this, 'SsmCmk', 'arn:aws:kms:us-east-1:111122223333:key/…');
const keyParam = StringParameter.fromStringParameterName(
  this,
  'AgeKeyParam',
  '/sops/age/private-key',
);
 
const provider = new SopsSyncProvider(this, 'SopsProvider');
provider.addAgeKeyFromSsmParameter(keyParam, cmk);

Combining with a static age key

Both methods can be used together. All keys — static and SSM-fetched — are merged and presented to sops during decryption:

import { SecretValue } from 'aws-cdk-lib';
import { Key } from 'aws-cdk-lib/aws-kms';
 
const cmk = Key.fromKeyArn(this, 'SsmCmk', 'arn:aws:kms:us-east-1:111122223333:key/…');
const provider = new SopsSyncProvider(this, 'SopsProvider');
 
// Statically injected at synthesis time (legacy approach)
provider.addAgeKey(SecretValue.ssmSecure('/sops/age/legacy-key'));
 
// Fetched from SSM at deploy time (recommended)
provider.addAgeKeyFromSsmParameter('/sops/age/current-key', cmk);

Multiple keys

Call addAgeKeyFromSsmParameter multiple times to register additional keys — useful for key rotation:

import { Key } from 'aws-cdk-lib/aws-kms';
 
const cmk = Key.fromKeyArn(this, 'SsmCmk', 'arn:aws:kms:us-east-1:111122223333:key/…');
const provider = new SopsSyncProvider(this, 'SopsProvider');
provider.addAgeKeyFromSsmParameter('/sops/age/key-v1', cmk);
provider.addAgeKeyFromSsmParameter('/sops/age/key-v2', cmk);