Terraform - Access SSM Parameter Store Value Access

Question

I would like some help / guidance on how to securely access SSM Parameter store for the (decrypted) value on an existing secureString for use in other terraform resources?

e.g we have a github access token stored in SSM for CI - I need to pass this value to the GitHub provider to enable webhooks for codepipeline.

The SSM Parameter is not something managed from terraform, but its decrypted value can be used.

Is this insecure given the value would end up in the state file? What is the best practice for this type of use case?

Many thanks!

Answer 1

You can use the data source to reference an already existing resource:

data "aws_ssm_parameter" "foo" {
  name = "foo"
}

one of the properties of the data source is value, which contains the actual value of the parameter. You can use this elsewhere in your terraform code:

data.aws_ssm_parameter.foo.value