SSMParameter | Praxis resources

Resource definition

What this resource looks like

This is the CUE shape a Praxis template uses to declare a SSMParameter. The resource key is local to the template; metadata.name supplies its stable Praxis identity.

resources: {
  configuration: {
  	apiVersion: "praxis.io/alpha"
  	kind:       "SSMParameter"
  	metadata: name: "/\(variables.name)/environment"
  	spec: {
  		region:      variables.region
  		value:       "production"
  		description: "Application environment"
  		tags:        _tags
  	}
  }
}

Excerpted from examples/stacks/foundation-services.cue. Open the complete example for its variables and related resources.

Complete examples in the repository

stacks foundation services

Desired state

Configuration

The spec block accepts 9 fields. 3 are required by the schema; fields with defaults can be omitted.

regionRequired

Region.

string

String

typeOptional

Type.

"String" | "StringList" | "SecureString" | *"String"

EnumDefault "String"

valueRequired

Value.

string

String

descriptionOptional

Description.

string

String

tierOptional

Tier.

"Standard" | "Advanced" | "Intelligent-Tiering" | *"Standard"

EnumDefault "Standard"

kmsKeyIdOptional

kmsKeyId is only valid for SecureString parameters; when omitted, the account default key (alias/aws/ssm) is used.

string

String

allowedPatternOptional

Allowed Pattern.

string

String

dataTypeOptional

Data Type.

"text" | "aws:ec2:image" | "aws:ssm:integration" | *"text"

EnumDefault "text"

tagsRequired

Tags.

[string]: string

Map

Observed values

Outputs

Praxis records these values after observation. A dependent resource can read one with ${resources.<name>.outputs.<field>}.

arnString

parameterNameString

typeString

versionInteger

tierString

dataTypeString · optional

Read without ownership

Data-source lookup

A data block reads an existing SSMParameter and exposes its outputs without storing lifecycle state. The generic filter surface accepts id, name, and tag; supported combinations depend on the AWS identity used by this resource.

data: existing: {
  kind: "SSMParameter"
  region: "us-west-2"
  filter: {
    name: "replace-with-provider-name"
  }
}

Understand data sources and filters →

Adopt existing infrastructure

Import

Import persists Praxis state for an existing AWS resource. For this kind, supply: Provider identifier for the existing SSMParameter. The example starts in observed mode so Praxis reports drift without correcting it.

praxis import SSMParameter \
  --id <provider-identifier> \
  --region us-west-2 \
  --account production \
  --observe

Choose managed or observed ownership →

Canonical contract

Complete CUE schema

The field guide above is derived from this definition. The schema remains the source of truth for accepted values, defaults, validation constraints, and outputs in the current alpha revision.

Show the complete schema

package ssm

import "strings"

#SSMParameter: {
	apiVersion: "praxis.io/alpha"
	kind:       "SSMParameter"

	metadata: {
		// Parameter names may be hierarchical paths, e.g. "/praxis/dev/db-host".
		name: string & strings.MinRunes(1) & strings.MaxRunes(1011) & =~"^[a-zA-Z0-9_.\\-/]+$"
		labels: [string]: string
	}

	spec: {
		region: string
		type:   "String" | "StringList" | "SecureString" | *"String"
		value:  string
		description?: string
		tier: "Standard" | "Advanced" | "Intelligent-Tiering" | *"Standard"
		// kmsKeyId is only valid for SecureString parameters; when omitted,
		// the account default key (alias/aws/ssm) is used.
		kmsKeyId?:       string
		allowedPattern?: string
		dataType: "text" | "aws:ec2:image" | "aws:ssm:integration" | *"text"
		tags: [string]: string
	}

	// Outputs intentionally exclude the parameter value so SecureString
	// values never flow into deployment state. Reference values with the
	// ssm:// resolver instead.
	outputs?: {
		arn:           string
		parameterName: string
		type:          string
		version:       int
		tier:          string
		dataType?:     string
	}
}

View this schema on GitHub →