Skip to content

SSM: add dependency on secretsmanager used by GetParameter #12896

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Jul 23, 2025
Merged

SSM: add dependency on secretsmanager used by GetParameter #12896

merged 1 commit into from
Jul 23, 2025

Conversation

dmacvicar
Copy link
Contributor

Motivation

SSM GetParameter uses secretsmanager service if the parameter matches the secrets pattern:

        if SsmProvider._has_secrets(names):
            return SsmProvider._get_params_and_secrets(context.account_id, context.region, names)

This means if localstack is ran with SERVICES, GetParameter operations fail:

awslocal ssm get-parameter --name "/aws/reference/secretsmanager/foo" --with-decryption

An error occurred (InternalError) when calling the GetParameter operation (reached max retries: 4): exception while calling ssm.GetParameter: Traceback (most recent call last):
...
botocore.exceptions.ClientError: An error occurred (InternalFailure) when calling the GetSecretValue operation: Service 'secretsmanager' is not enabled. Please check your 'SERVICES' configuration variable.

Changes

This PR adds an explicit dependency between the services.

Testing

Start localstack with SERVICES=ssm and run:

awslocal ssm get-parameter --name "/aws/reference/secretsmanager/foo" --with-decryption
  • Before the change you would get the exception about secretmanager not enabled.
  • After you will get:
An error occurred (ParameterNotFound) when calling the GetParameter operation: An error occurred (ParameterNotFound) when referencing Secrets Manager: Secret /aws/reference/secretsmanager/foo not found.

@dmacvicar dmacvicar added aws:ssm AWS Systems Manager semver: patch Non-breaking changes which can be included in patch releases type: bug Bug report labels Jul 23, 2025
@dmacvicar dmacvicar requested a review from silv-io July 23, 2025 11:27
silv-io
silv-io approved these changes Jul 23, 2025
View reviewed changes
Copy link
Member

@silv-io silv-io left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@dmacvicar dmacvicar merged commit 8dfb804 into localstack:main Jul 23, 2025
40 of 41 checks passed
@dmacvicar dmacvicar deleted the ssm_load_secretsmanager branch July 23, 2025 12:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@silv-io silv-io silv-io approved these changes

Assignees
No one assigned
Labels
aws:ssm AWS Systems Manager semver: patch Non-breaking changes which can be included in patch releases type: bug Bug report
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@dmacvicar @silv-io