add shared path to SSM parameters

atc/api/info_test.go

@@ -108,7 +108,7 @@ var _ = Describe("Pipelines API", func() {
 				fakeAccess.IsAuthenticatedReturns(true)
 				fakeAccess.IsAdminReturns(true)
 
-				ssmAccess := ssm.NewSsm(lager.NewLogger("ssm_test"), &mockService, nil)
+				ssmAccess := ssm.NewSsm(lager.NewLogger("ssm_test"), &mockService, nil, "")
 				ssmManager := &ssm.SsmManager{
 					AwsAccessKeyID:         "",
 					AwsSecretAccessKey:     "",
@@ -140,6 +140,7 @@ var _ = Describe("Pipelines API", func() {
 							"method": "GetParameter"
 						},
 						"pipeline_secret_template": "pipeline-secret-template",
+            "shared_path": "",
 						"team_secret_template": "team-secret-template"
           }
         }`))
@@ -165,6 +166,7 @@ var _ = Describe("Pipelines API", func() {
 							"method": "GetParameter"
 						},
 						"pipeline_secret_template": "pipeline-secret-template",
+            "shared_path": "",
 						"team_secret_template": "team-secret-template"
           }
         }`))

atc/creds/ssm/manager.go

@@ -24,6 +24,7 @@ type SsmManager struct {
 	AwsRegion              string `mapstructure:"region" long:"region" description:"AWS region to send requests to"`
 	PipelineSecretTemplate string `mapstructure:"pipeline_secret_template" long:"pipeline-secret-template" description:"AWS SSM parameter name template used for pipeline specific parameter" default:"/concourse/{{.Team}}/{{.Pipeline}}/{{.Secret}}"`
 	TeamSecretTemplate     string `mapstructure:"team_secret_template" long:"team-secret-template" description:"AWS SSM parameter name template used for team specific parameter" default:"/concourse/{{.Team}}/{{.Secret}}"`
+	SharedPath             string `mapstructure:"shared_path" long:"shared-path" description:"AWS SSM parameter path used for shared parameters"`
 	Ssm                    *Ssm
 }
 
@@ -37,6 +38,7 @@ func (manager *SsmManager) MarshalJSON() ([]byte, error) {
 		"aws_region":               manager.AwsRegion,
 		"pipeline_secret_template": manager.PipelineSecretTemplate,
 		"team_secret_template":     manager.TeamSecretTemplate,
+		"shared_path":              manager.SharedPath,
 		"health":                   health,
 	})
 }
@@ -139,7 +141,7 @@ func (manager *SsmManager) NewSecretsFactory(log lager.Logger) (creds.SecretsFac
 		return nil, err
 	}
 
-	return NewSsmFactory(log, session, []*creds.SecretTemplate{pipelineSecretTemplate, teamSecretTemplate}), nil
+	return NewSsmFactory(log, session, []*creds.SecretTemplate{pipelineSecretTemplate, teamSecretTemplate}, manager.SharedPath), nil
 }
 
 func (manager *SsmManager) Close(logger lager.Logger) {

atc/creds/ssm/ssm.go

@@ -17,13 +17,15 @@ type Ssm struct {
 	log             lager.Logger
 	api             ssmiface.SSMAPI
 	secretTemplates []*creds.SecretTemplate
+	sharedPath      string
 }
 
-func NewSsm(log lager.Logger, api ssmiface.SSMAPI, secretTemplates []*creds.SecretTemplate) *Ssm {
+func NewSsm(log lager.Logger, api ssmiface.SSMAPI, secretTemplates []*creds.SecretTemplate, sharedPath string) *Ssm {
 	return &Ssm{
 		log:             log,
 		api:             api,
 		secretTemplates: secretTemplates,
+		sharedPath:      sharedPath,
 	}
 }
 
@@ -35,6 +37,9 @@ func (s *Ssm) NewSecretLookupPaths(teamName string, pipelineName string, allowRo
 			lookupPaths = append(lookupPaths, lPath)
 		}
 	}
+	if s.sharedPath != "" {
+		lookupPaths = append(lookupPaths, creds.NewSecretLookupWithPrefix(s.sharedPath+"/"))
+	}
 	return lookupPaths
 }
 

atc/creds/ssm/ssm_factory.go

@@ -11,16 +11,18 @@ type ssmFactory struct {
 	log             lager.Logger
 	api             *ssm.SSM
 	secretTemplates []*creds.SecretTemplate
+	sharedPath      string
 }
 
-func NewSsmFactory(log lager.Logger, session *session.Session, secretTemplates []*creds.SecretTemplate) *ssmFactory {
+func NewSsmFactory(log lager.Logger, session *session.Session, secretTemplates []*creds.SecretTemplate, sharedPath string) *ssmFactory {
 	return &ssmFactory{
 		log:             log,
 		api:             ssm.New(session),
 		secretTemplates: secretTemplates,
+		sharedPath:      sharedPath,
 	}
 }
 
 func (factory *ssmFactory) NewSecrets() creds.Secrets {
-	return NewSsm(factory.log, factory.api, factory.secretTemplates)
+	return NewSsm(factory.log, factory.api, factory.secretTemplates, factory.sharedPath)
 }

atc/creds/ssm/ssm_test.go

@@ -98,7 +98,7 @@ var _ = Describe("Ssm", func() {
 		t2, err := creds.BuildSecretTemplate("t2", DefaultTeamSecretTemplate)
 		Expect(t2).NotTo(BeNil())
 		Expect(err).To(BeNil())
-		ssmAccess = NewSsm(lagertest.NewTestLogger("ssm_test"), &mockService, []*creds.SecretTemplate{t1, t2})
+		ssmAccess = NewSsm(lagertest.NewTestLogger("ssm_test"), &mockService, []*creds.SecretTemplate{t1, t2}, "/concourse/shared")
 		variables = creds.NewVariables(ssmAccess, "alpha", "bogus", false)
 		Expect(ssmAccess).NotTo(BeNil())
 		mockService.stubGetParameter = func(input string) (string, error) {
@@ -120,7 +120,7 @@ var _ = Describe("Ssm", func() {
 			Expect(err).To(BeNil())
 		})
 
-		It("should get complex paramter", func() {
+		It("should get complex parameter", func() {
 			mockService.stubGetParametersByPathPages = func(path string) []mockPathResultPage {
 				return []mockPathResultPage{
 					{
@@ -164,6 +164,19 @@ var _ = Describe("Ssm", func() {
 			Expect(err).To(BeNil())
 		})
 
+		It("should get shared parameter if exists", func() {
+			mockService.stubGetParameter = func(input string) (string, error) {
+				if input != "/concourse/shared/cheery" {
+					return "", awserr.New(ssm.ErrCodeParameterNotFound, "", nil)
+				}
+				return "shared decrypted value", nil
+			}
+			value, found, err := variables.Get(varRef)
+			Expect(value).To(BeEquivalentTo("shared decrypted value"))
+			Expect(found).To(BeTrue())
+			Expect(err).To(BeNil())
+		})
+
 		It("should return not found on error", func() {
 			mockService.stubGetParameter = nil
 			value, found, err := variables.Get(varRef)