Dynamic bref-ssm

[cirolosapio]

as per doc https://bref.sh/docs/environment/variables#at-runtime
we can use bref-ssm:path instead of ${ssm:path} to fetch the secret values at runtime:

provider:
    environment:
        MY_PARAMETER: bref-ssm:/my-app/my-parameter

is it possbile to mix bref-ssm and other serverless variables?

Example:

service: badgeapp

provider:
    environment:
        APP_KEY: bref-ssm:/${self:service}/APP_KEY

[mnapoli]

Yes that will work 👍

[cirolosapio]

perfect thanks
also great product!
i ❤️ bref

one more question:
do I understand correctly that in this way, and with bref/secrets-loader, the environment variables are loaded at runtime?
i've tryed to deploy a laravel app and toggle for example APP_DEBUG with true/false values but the value is not updated/loaded on every request
have to re-deploy the app/function to see the actual changes?

[mnapoli]

The value is retrieved when the Lambda instance starts but is not updated afterward (the environment variable is kept, not updated). So you do have to re-deploy (or wait for all Lambda instances to update, which could take hours, that could work in non-critical scenarios I guess…).

[cirolosapio]

oh ok
so what is the main benefit of bref-ssm over ${ssm}? 🤔
i think I should re-read the docs 🥲

[cirolosapio]

ah ok the benefits are:

• more secure, it doesn't store the value in the aws console
• and the value doesn't have to be accessible by the user deploying

great thank you!