paramsync

$ paramsync check
=====================================================================================
myapp-private
local:path/private => ssm:us-east-1:private/myapp
  Keys scanned: 37
No changes to make for this sync target.

=====================================================================================
myapp-config
local:path/config => ssm:us-east-1:config/myapp
  Keys scanned: 80

UPDATE config/myapp/prod/ip-allowlist.json
-------------------------------------------------------------------------------------
-["10.8.0.0/16"]
+["10.8.0.0/16","10.9.10.0/24"]
-------------------------------------------------------------------------------------

Keys to update: 1
~ config/myapp/prod/ip-allowlist.json

$ paramsync push --target myapp-config
=====================================================================================
myapp-config
local:path/config => ssm:us-east-1:config/myapp
  Keys scanned: 80

UPDATE config/myapp/prod/ip-allowlist.json
-------------------------------------------------------------------------------------
-["10.8.0.0/16"]
+["10.8.0.0/16","10.9.10.0/24"]
-------------------------------------------------------------------------------------

Keys to update: 1
~ config/myapp/prod/ip-allowlist.json

Do you want to push these changes?
  Enter 'yes' to continue: yes

UPDATE config/myapp/prod/ip-allowlist.json   OK

# paramsync.yml

paramsync:
  # verbose - defaults to `false`
  #   Set this to `true` for more verbose output.
  verbose: false

  # chomp - defaults to `true`
  #   Automatically runs `chomp` on the strings read in from files to
  #   eliminate a single trailing newline character (commonly inserted
  #   by text editors). Set to `false` to disable this by default for
  #   all sync targets (it can be overridden on a per-target basis).
  chomp: true

  # delete - defaults to `false`
  #   Set this to `true` to make the default for all sync targets to
  #   delete any keys found in parameter store that do not have a corresponding
  #   file on disk. By default, extraneous remote keys will be ignored.
  #   If `verbose` is set to `true` the extraneous keys will be named
  #   in the output.
  delete: false

  # color - defaults to `true`
  #   Set this to `false` to disable colorized output (eg when running
  #   with an automated tool).
  color: true

ssm:
  accounts:
    account1:
      role: arn:aws:iam::123456789012:role/admin

sync:
  # sync is an array of hashes of sync target configurations
  #   Fields:
  #     name - The arbitrary friendly name of the sync target. Only
  #       required if you wish to target specific sync targets using
  #       the `--target` CLI flag.
  #     prefix - (required) The parameter store prefix to synchronize to.
  #     type - (default: "dir") The type of local file storage. Either
  #       'dir' to indicate a directory tree of files corresponding to
  #       parameter store keys; or 'file' to indicate a single YAML file with a
  #       map of relative key paths to values.
  #     region - (required) The aws region to synchronize to
  #     path - (required) The relative filesystem path to either the
  #       directory containing the files with content to synchronize
  #       to parameter store if this sync target has type=dir, or the local file
  #       containing a hash of remote keys if this sync target has
  #       type=file. This path is calculated relative to the directory
  #       containing the configuration file.
  #     account - (account) The account from the ssm block to use
  #     delete - Whether or not to delete remote keys that do not exist
  #       in the local filesystem. This inherits the setting from the
  #       `paramsync` section, or if not specified, defaults to `false`.
  #     chomp - Whether or not to chomp a single newline character off
  #       the contents of local files before synchronizing to parameter store.
  #       This inherits the setting from the `paramsync` section, or if
  #       not specified, defaults to `true`.
  #     exclude - An array of parameter store paths to exclude from the
  #       sync process. These exclusions will be noted in output if the
  #       verbose mode is in effect, otherwise they will be silently
  #       ignored. At this time there is no provision for specifying
  #       prefixes or patterns. Each key must be fully and explicitly
  #       specified.
  #     erb_enabled - Whether or not to run the local content through
  #       ERB parsing before attempting to sync to the remote. Defaults
  #       to `false`.
  - name: myapp-config
    prefix: config/myapp
    region: us-east-1
    path: path/config
    exclude:
      - config/myapp/beta.cowboy-yolo
      - config/myapp/prod.cowboy-yolo
    account: account1
  - name: myapp-private
    prefix: private/myapp
    type: dir
    region: us-east-1
    path: path/private
    account: account1
    delete: true
  - name: yourapp-config
    prefix: config/yourapp
    type: file
    region: us-east-1
    path: path/yourapp.yml
    delete: true
    erb_enabled: true

sync:
  - name: config
    prefix: config/yourapp
    type: file
    region: us-east-1
    path: yourapp.yml

---
prod/dbname: yourapp
prod/message: |
  Hello, world. This is a multiline message.
  Thanks.
prod/app/config.json: |
  {
    "port": 8080,
    "enabled": true
  }

---
prod:
  redis:
    port: 6380
    host: redis.example.com

---
prod/postgres:
  host: db.myproject.example.com
  port: 10001

prod:
  redis:
    _: Embedded Value
    port: 6380

prod/redis/host: cache.myproject.example.com

sync:
<% %w( us-east-1 us-west-2 ).each do |region| %>
  - name: <%= dc %>:myapp-private
    prefix: private/myapp
    region: <%= region %>
    path: path/<%= region %>/private
    delete: true
<% end %>