How to integrate AWS paramater store to encrypt token / API keys with Python code on EC2?

Question

I am creating a telegram bot. This requires me to include a token in my Python code to access my bot. I am pretty sure that I should keep it in AWS parameter store so that it is more secure. I am unsure how to do so with the following questions:

• Which python package & function should I use so that I can reference the stored token in AWS parameter store?
• Correct me if I'm wrong, but I also need to give my EC2 instance the IAM role to access my AWS parameter store, right?
• Can I confirm that I shouldn't use AWS secrets manager since I don't intend to rotate this fixed token for my bot?

P.S. Sorry if these are very basic questions. I wasn't sure where to find resources to specifically integrate AWS parameter store with Python code.

Answer 1

Which python package & function should I use so that I can reference the stored token in AWS parameter store?

You can use boto3's get_parameter function.

I also need to give my EC2 instance the IAM role to access my AWS parameter store, right?

Yes.

Can I confirm that I shouldn't use AWS secrets manager since I don't intend to rotate this fixed token for my bot?

SSM Paramter Store is free, unlike AWS secrets manager. But you could still use it if you like.

Answer 2

1. Which python package & function should I use so that I can reference the stored token in AWS parameter store?

I prefer to use pysecret library + boto3. you can easily read / write, with or without encryption, using dictionary or user defined class. You can find code example here https://pysecret.readthedocs.io/index.html#aws-system-manager-parameter-store-integration

2. Correct me if I'm wrong, but I also need to give my EC2 instance the IAM role to access my AWS parameter store, right?

yes, you need this IAM policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "ssm:GetParameter",
            "Resource": [
                "arn:aws:ssm:us-east-1:111122223333:parameter/name1",
                "arn:aws:ssm:us-east-1:111122223333:parameter/name2"
            ]
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "ssm:DescribeParameters",
            "Resource": "*"
        }
    ]
}

3. Can I confirm that I shouldn't use AWS secrets manager since I don't intend to rotate this fixed token for my bot?

parameter store support encryption as well. the main reason using secrets manager is auto-rotation. And you usually don't use secrets manager to store big structured parameters. For example, if your data is like 100+ key/value pair, or you have nested field, you should not use secret manager.

In additional reading secrets manager is more expensive than parameter store.