AWS .NET Configuration Extension for Systems Manager

Amazon.Extensions.Configuration.SystemsManager simplifies using AWS SSM's Parameter Store and AppConfig as a source for configuration information for .NET Core applications. This project was contributed by @KenHundley and @MichalGorski.

The library introduces the following dependencies:

• AWSSDK.Extensions.NETCore.Setup
• AWSSDK.SimpleSystemsManagement
• AWSSDK.AppConfig
• Microsoft.Extensions.Configuration

Getting Started

Follow the examples below to see how the library can be integrated into your application. This extension adheres to the same practices and conventions of Configuration in ASP.NET Core.

ASP.NET Core Example

One of the common use cases for this library is to pull configuration from Parameter Store. You can easily add this functionality by adding 1 line of code.

public class Program
{
    public static void Main(string[] args)
    {
        CreateWebHostBuilder(args).Build().Run();
    }

    public static IWebHostBuilder CreateWebHostBuilder(string[] args) =>
        WebHost.CreateDefaultBuilder(args)
            .ConfigureAppConfiguration(builder =>
            {
                builder.AddSystemsManager("/my-application/");
            })
            .UseStartup<Startup>();
}

It is also possible to load AWS Secrets Manager secrets from Parameter Store parameters. When retrieving a Secrets Manager secret from Parameter Store, the name must begin with the following reserved path: /aws/reference/secretsmanager/{Secret-Id}. Below example demonstrates this use case:

public class Program
{
    public static void Main(string[] args)
    {
        CreateWebHostBuilder(args).Build().Run();
    }

    public static IWebHostBuilder CreateWebHostBuilder(string[] args) =>
        WebHost.CreateDefaultBuilder(args)
            .ConfigureAppConfiguration(builder =>
            {
                builder.AddSystemsManager("/aws/reference/secretsmanager/SomeSecret");
            })
            .UseStartup<Startup>();
}

For loading secrets, the library will use JsonParameterProcessor to load Key/Value pairs stored in the secret. These Key/Value pairs could be retrieved from the ConfigurationManager object. For more details, kindly refer Referencing AWS Secrets Manager secrets from Parameter Store parameters.

Another possibility is to pull configuration from AppConfig. You can easily add this functionality by adding 1 line of code.

public class Program
{
    public static void Main(string[] args)
    {
        CreateWebHostBuilder(args).Build().Run();
    }

    public static IWebHostBuilder CreateWebHostBuilder(string[] args) =>
        WebHost.CreateDefaultBuilder(args)
            .ConfigureAppConfiguration(builder =>
            {
                builder.AddAppConfig("AppConfigApplicationId", "AppConfigEnvironmentId", "AppConfigConfigurationProfileId", TimeSpan.FromSeconds(20));
            })
            .UseStartup<Startup>();
}

HostBuilder Example

Microsoft introduced .NET Generic Host to de-couple HTTP pipeline from the Web Host API. The Generic Host library allows you to write non-HTTP services using configuration, dependency injection, and logging features. The sample code below shows you how to use the AWS .NET Configuration Extension library:

namespace HostBuilderExample
{
    public static async Task Main(string[] args)
    {
        var host = new HostBuilder()
            .ConfigureAppConfiguration((hostingContext, config) =>
            {
                config.AddSystemsManager("/my-application/");
                config.AddAppConfig("AppConfigApplicationId", "AppConfigEnvironmentId", "AppConfigConfigurationProfileId", TimeSpan.FromSeconds(20));
            })
            .ConfigureServices((sc) => { ... })
            .Build();

        await host.RunAsync();
    }
}

AWS Lambda Example

For improved performance with AppConfig and Lambda it is recommended to use the AddAppConfigUsingLambdaExtension method and deploy the Lambda function with the AWS AppConfig Lambda extension. More information including the AppConfig Lambda extension layer arn can be found in the AWS AppConfig user guide.

var configurations = new ConfigurationBuilder()
                        .AddSystemsManager("/my-application/")
                        .AddAppConfigUsingLambdaExtension("AppConfigApplicationId", "AppConfigEnvironmentId", "AppConfigConfigurationProfileId")
                        .Build();

Config reloading

The reloadAfter parameter on AddSystemsManager() and AddAppConfig() enables automatic reloading of configuration data from Parameter Store or AppConfig as a background task. When using AddAppConfigUsingLambdaExtension reload is automatically configured.

Config reloading in AWS Lambda

In AWS Lambda, background tasks are paused after processing the AWS Lambda event. This could disrupt the provider from retrieving the latest configuration data from Parameter Store or AWS AppConfig. To ensure the reload is performed within the AWS Lambda event, we recommend calling the extension method WaitForSystemsManagerReloadToComplete from the IConfiguration object in the beginning of your AWS Lambda function handler. This method will immediately return unless a reload is currently being performed.

Remember to build IConfiguration in the AWS Lambda constructor! It is the only way to cache the configuration and reload it using reloadAfter parameter.

public class SampleLambda
{
    private readonly IConfiguration _configurations;
    
    public SampleLambda()
    {
        _configurations = new ConfigurationBuilder()
                            .AddSystemsManager("/my-application/")
                            .AddAppConfigForLambda("AppConfigApplicationId", "AppConfigEnvironmentId", "AppConfigConfigurationProfileId", TimeSpan.FromSeconds(20))
                            .Build();
    }

    protected void Invoke()
    {
        _configurations.WaitForSystemsManagerReloadToComplete(TimeSpan.FromSeconds(2));
    }
}

Hierarchical configuration data

Let's assume we want to load configuration per the below class hierarchy:

public class DemoConfig
{
    public string TestItem { get; set; }
    public DemoSubConfig SubConfig { get; set; }
}

public class DemoSubConfig
{
    public string SubItem { get; set; }
}

In System Manager parameter store, these hierarchical values could be represented with below names (notice the use of / delimiter):

Name	Type
/my-application/Config/TestItem	String
/my-application/Config/SubConfig/SubItem	String

Using WebApplicationBuilder as an example, the above configuration hierarchy could be loaded using below code:

var builder = WebApplication.CreateBuilder(args);

builder.Configuration.AddSystemsManager($"/my-application/");

builder.Services.Configure<DemoConfig>(builder.Configuration.GetSection("Config"));

Samples

Custom ParameterProcessor Sample

Example of using a custom IParameterProcessor which provides a way to store and retrieve null values. Since AWS Parameter Store params are string literals, there is no way to store a null value by default.

namespace CustomParameterProcessorExample
{
    public class CustomParameterProcessor : DefaultParameterProcessor
    {
        const string NULL_STRING_LITERAL = "NULL";
        
        public override string GetValue(Parameter parameter, string path)
        {
            string value = base.GetValue(parameter, path);
            return value == NULL_STRING_LITERAL ? null : value;
        }
    }
    
    public class Program
    {
        public static void Main(string[] args)
        {
            CreateWebHostBuilder(args).Build().Run();
        }

        public static IWebHostBuilder CreateWebHostBuilder(string[] args) =>
            WebHost.CreateDefaultBuilder(args)
                .ConfigureAppConfiguration(builder =>
                {
                    builder.AddSystemsManager(config => {
                        config.Path = "/my-application/";
                        config.ParameterProcessor = new CustomParameterProcessor();
                    });
                })
                .UseStartup<Startup>();
    }
}

For more complete examples, take a look at sample projects available in samples directory.

Configuring Systems Manager Client

This extension is using AWSSDK.Extensions.NETCore.Setup to get AWSOptions from Configuration object and create AWS Systems Manager Client. You can edit and override the configuration by adding AWSOptions to your configuration providers such as appsettings.Development.json. Below is an example of a configuration provider:

{
  ...

  "AWS": {
    "Profile": "default",
    "Region": "us-east-1",
    "ResignRetries": true
  }

  ...
}

For more information and other configurable options please refer to Configuring the AWS SDK for .NET with .NET Core.

Permissions

Parameter Store

The AWS credentials used must have access to the ssm:GetParametersByPath service operation from AWS System Manager. Below is an example IAM policy for this action.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "SSMPermissionStatement",
            "Effect": "Allow",
            "Action": "ssm:GetParametersByPath",
            "Resource": "arn:aws:ssm:${Region}:${Account}:parameter/${ParameterNamePrefix}*"
        }
    ]
}

The above policy gives user access to get and use parameters which begin with the specified prefix.

For more details, refer Restricting access to Systems Manager parameters using IAM policies.

Additionally, for referencing secrets from AWS Secrets Manager from Paramater Store parameters, AWS credentials used must have permissions to access the secret.

AppConfig

If the application reads configuration values from AWS Systems Manager AppConfig, the AWS credentials used must have access to appconfig:StartConfigurationSession and appconfig:GetLatestConfiguration service operations. Below is an example IAM policy for this action.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "appconfig:StartConfigurationSession",
        "appconfig:GetLatestConfiguration",
      ],
      "Resource": "arn:${Partition}:appconfig:${Region}:${Account}:application/${ApplicationId}/environment/${EnvironmentId}/configuration/${ConfigurationProfileId}"
    }
  ]
}

For more details, refer Configuring permissions for AWS AppConfig and Actions, resources, and condition keys for AWS AppConfig.

Getting Help

We use the GitHub issues for tracking bugs and feature requests and have limited bandwidth to address them.

If you think you may have found a bug, please open an issue.

Contributing

We welcome community contributions and pull requests. See CONTRIBUTING.md for information on how to set up a development environment and submit code.

Additional Resources

AWS .NET GitHub Home Page
GitHub home for .NET development on AWS. You'll find libraries, tools, and resources to help you build .NET applications and services on AWS.

AWS Developer Center - Explore .NET on AWS
Find all the .NET code samples, step-by-step guides, videos, blog content, tools, and information about live events that you need in one place.

AWS Developer Blog - .NET
Come see what .NET developers at AWS are up to! Learn about new .NET software announcements, guides, and how-to's.

@dotnetonaws Follow us on twitter!

License

Libraries in this repository are licensed under the Apache 2.0 License.

See LICENSE and NOTICE for more information.