Commands

Commands

All commands support --help for inline documentation:

ssm-explorer --help
ssm-explorer list --help
ssm-explorer diff --help

Command	Description
check	Verify install, config, profile & region (offline)
list	List all parameters under a path
search	Filter parameters by path or value pattern
get	Get a single parameter value
browse	Interactively browse parameters in a TUI
deepsearch	Search across multiple profiles & regions at once
diff	Compare parameters across paths, profiles, or regions
export	Export parameters to a .env or JSON file
config	View and manage local configuration

---

check

Validates your local install, config, AWS profile names, and known SSM regions. Offline by default — does not call AWS APIs.

# Use config defaults
ssm-explorer check

# Validate a specific profile and region
ssm-explorer check --profile my_profile_aws --region eu-west-1

---

list

Lists all parameters under a path, displayed as ENV_VAR → value.

ssm-explorer list /my/path/to/var \
  --profile my_profile_aws \
  --region eu-west-1

# With SecureString decryption
ssm-explorer list /my/path/to/var \
  --profile my_profile_aws \
  --decrypt

# JSON output for scripting/pipelines
ssm-explorer list /my/path/to/var \
  --profile my_profile_aws \
  --output json

Terminal output example:

┌─────────────────────────────────────────────────────────────────────┐
│              SSM Parameter Store — /my/path/to/var                  │
│                   Profile: my_profile_aws  •  Region: eu-west-1     │
└─────────────────────────────────────────────────────────────────────┘

 Parameter Store Results (3 parameters)

 ┌──────────────┬──────────────────────────────┬───────────────────┐
 │ ENV Variable │ Full Path                    │ Value             │
 ├──────────────┼──────────────────────────────┼───────────────────┤
 │ DATABASE_URL │ /my/path/to/var/DATABASE_URL │ postgres://db:... │
 │ REDIS_HOST   │ /my/path/to/var/REDIS_HOST   │ my-redis.cache... │
 │ API_KEY      │ /my/path/to/var/API_KEY      │ *** (encrypted)   │
 └──────────────┴──────────────────────────────┴───────────────────┘

---

search

Search/filter parameters by path segment or value pattern.

# Filter by path containing "DATABASE"
ssm-explorer search /my/path/to/var \
  --profile my_profile_aws \
  --filter-path DATABASE

# Filter by value pattern
ssm-explorer search /my/path/to/var \
  --profile my_profile_aws \
  --filter-value "postgres://"

# Combine path and value filters
ssm-explorer search /my/path/to/var \
  --profile my_profile_aws \
  --filter-path DB \
  --filter-value "5432"

---

get

Retrieve the value of a single parameter by its full path.

ssm-explorer get /my/path/to/var/DATABASE_URL \
  --profile my_profile_aws \
  --decrypt

---

browse

Loads all parameters from a path and opens a real-time interactive TUI. Type to filter instantly.

# Open interactive browser
ssm-explorer browse /my/path/to/var --profile my_profile_aws

# With SecureString decryption
ssm-explorer browse /my/path/to/var --profile my_profile_aws --decrypt

# Print raw value to stdout after selection
ssm-explorer browse /my/path --output value

TUI controls:

Key	Action
Type	Filter parameters in real-time
Tab	Switch between filtering by ENV name or by value
↑ / ↓	Navigate results
Enter	Inspect the selected parameter
Esc / Ctrl+C	Exit

---

deepsearch

Search for parameters simultaneously across multiple AWS profiles and regions in a single command.

# Search across profile/region combinations
ssm-explorer deepsearch \
  --profile dev,prod \
  --region us-east-1,eu-west-1 \
  --filter-path "DATABASE"

# With value filtering and decryption
ssm-explorer deepsearch \
  --profile dev,stage \
  --region us-east-1 \
  --filter-value "postgres://" \
  --decrypt

---

diff

Compare parameter sets across different paths, AWS accounts, or regions.

Two paths in the same account

ssm-explorer diff /app/dev /app/prod --profile my_profile_aws

Same path across two AWS accounts

ssm-explorer diff /app/config \
  --profile-a my_dev_account \
  --profile-b my_prod_account

Same account across regions

ssm-explorer diff /app/config \
  --profile-a default \
  --region-a us-east-1 \
  --region-b eu-west-1

Different paths across two accounts

ssm-explorer diff /app/dev/config /app/prod/config \
  --profile-a my_dev_account \
  --profile-b my_prod_account

Explicit region per account

ssm-explorer diff /app/config \
  --profile-a stage_account \
  --region-a us-west-2 \
  --profile-b prod_account \
  --region-b eu-central-1

Show differences only / exclude missing

# Exclude identical values
ssm-explorer diff /app/config \
  --profile-a stage_account \
  --profile-b prod_account \
  --region eu-west-1 \
  --exc-identicals

# Exclude parameters that exist only in source B
ssm-explorer diff /app/config \
  --profile-a stage_account \
  --profile-b prod_account \
  --region eu-west-1 \
  --exc-missing-a

Filter by path pattern

ssm-explorer diff \
  --profile-a stage_account \
  --region-a us-west-2 \
  --path-a /app/config \
  --profile-b prod_account \
  --region-b eu-central-1 \
  --path-b /app/config \
  --filter-path browser

Flag reference

Flag	Description
--profile-a/b	AWS profile for source A or B
--region	Shared region for both sources
--region-a/b	Region override per source
--path-a/b	Explicit path override per source
--filter-path	Only diff parameters whose full path contains this string
--exc-identicals	Exclude parameters with identical values in both sources
--exc-missing-a	Exclude parameters that exist only in source B

---

export

Export parameters as a .env file or JSON.

# Export to .env
ssm-explorer export /my/path/to/var \
  --profile my_profile_aws \
  --decrypt \
  --format env \
  --output-file .env

# Export to JSON
ssm-explorer export /my/path/to/var \
  --profile my_profile_aws \
  --format json \
  --output-file params.json

Flag	Description
--format	env or json
--output-file	Destination file path
--decrypt	Decrypt SecureString values

---

config

Manage your local config.toml directly from the CLI.

# Print the active config file path
ssm-explorer config path

# Initialise a default config.toml
ssm-explorer config init

# Display effective configuration settings
ssm-explorer config show

# Set a configuration value
ssm-explorer config set aws.profile my_dev_profile
ssm-explorer config set display.max_value_length 100

See Configuration for the full config file reference.