> ## Documentation Index
> Fetch the complete documentation index at: https://astronomer.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up AWS Systems Manager (SSM) Parameter Store

In this section, you'll learn how to use [AWS Systems Manager (SSM) Parameter Store](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html) as a secrets backend on Astro.

If you use a different secrets backend tool or want to learn the general approach on how to integrate one, see [Configure a Secrets Backend](/docs/astro/secrets-backend).

## Prerequisites

* A [Deployment](/docs/astro/create-deployment).
* The [Astro CLI](/docs/cli/v1.43/overview).
* An [Astro project](/docs/cli/v1.43/develop-project#create-an-astro-project) with version 5.1.0+ of `apache-airflow-providers-amazon`. See [Add Python and OS-level packages](/docs/cli/v1.43/add-providers-packages).
* An IAM role with access to the [Parameter Store](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-paramstore-access.html) that your Astro cluster can assume.
* (Remote Execution Only) [Helm installed](https://helm.sh/docs/intro/install/)
* (Remote Execution Only) The `values.yaml` file from the **Register Agents** modal in your **Deployments**>**Agents** page.

## Step 1: Create Airflow secrets directories in Parameter Store

Create directories for Airflow variables and connections in Parameter Store that you want to store as secrets.

Variables and connections should be stored in `/airflow/variables` and `/airflow/connections`, respectively. For example, if you're setting a secret variable with the key `my_secret`, it should be stored in the `/airflow/connections/` directory. If you modify the directory paths, make sure you change the values for `variables_prefix` and `connections_prefix` in Step 2.

For instructions, see the [AWS Systems Manager Console](https://docs.aws.amazon.com/systems-manager/latest/userguide/parameter-create-console.html), the [AWS CLI](https://docs.aws.amazon.com/systems-manager/latest/userguide/param-create-cli.html), or the [Tools for Windows PowerShell](https://docs.aws.amazon.com/systems-manager/latest/userguide/param-create-ps.html) documentation.

## Step 2: Set up Parameter Store locally

<Tabs>
  <Tab title="Astro">
    Add the following environment variables to your Astro project's `.env` file:

    ```text wrap theme={null}
    AIRFLOW__SECRETS__BACKEND=airflow.providers.amazon.aws.secrets.systems_manager.SystemsManagerParameterStoreBackend
    AIRFLOW__SECRETS__BACKEND_KWARGS={"connections_prefix": "airflow/connections", "variables_prefix": "airflow/variables",  "role_arn": "<your-role-arn>", "region_name": "<your-region>"}
    ```

    You can now run a dag locally to check that your variables are accessible using `Variable.get("<your-variable-key>")`.
  </Tab>

  <Tab title="Remote Execution" id="remote-execution">
    In your Astro project, add the [AWS Systems Manager (SSM) Parameter Store](https://airflow.apache.org/docs/apache-airflow-providers-amazon/stable/secrets-backends/aws-ssm-parameter-store.html) to your project by adding the following to your `values.yaml` file to set the secrets backend class to use the provider and configure your secrets backend kwargs:

    ```yaml title="values.yaml" wrap theme={null}
    secretBackend: "airflow.providers.amazon.aws.secrets.systems_manager.SystemsManagerParameterStoreBackend"

    commonEnv:
      - name: AIRFLOW__SECRETS__BACKEND_KWARGS
        value: '{"connections_prefix": "airflow/connections", "variables_prefix": "airflow/variables",  "role_arn": "<your-role-arn>", "region_name": "<your-region>"}'
    ```

    You need to run the Remote Execution Agent with AWS credentials to fetch from your secrets manager.

    <Tip>
      For secure production environments, you can store sensitive Kwargs containing secret ID and app role ID in a secret:

      ```yaml title="values.yaml" wrap theme={null}
      commonEnv:
        - name: AIRFLOW__SECRETS__BACKEND_KWARGS
          valueFrom:
            secretKeyRef:
              name: airflow-secret-backend
              key: '{"connections_prefix": "airflow/connections", "variables_prefix": "airflow/variables",  "role_arn": "<your-role-arn>", "region_name": "<your-region>"}'
      ```
    </Tip>
  </Tab>
</Tabs>

## Step 3: Deploy configuration

<Tabs>
  <Tab title="Astro">
    1. Run the following commands to export your secrets backend configurations as environment variables to Astro.

       ```sh wrap theme={null}
       astro deployment variable create --deployment-id <your-deployment-id> AIRFLOW__SECRETS__BACKEND=airflow.providers.amazon.aws.secrets.systems_manager.SystemsManagerParameterStoreBackend

       astro deployment variable create --deployment-id <your-deployment-id> AIRFLOW__SECRETS__BACKEND_KWARGS='{"connections_prefix": "airflow/connections", "variables_prefix": "airflow/variables",  "role_arn": "<your-role-arn>", "region_name": "<your-region>"}' --secret
       ```

    2. (Optional) Remove the environment variables from your `.env` file or store your `.env` file in a safe location to protect your credentials in `AIRFLOW__SECRETS__BACKEND_KWARGS`.
  </Tab>

  <Tab title="Remote Execution" id="remote-execution">
    1. Run the following command to update your Remote Execution Agent with your new configurations.

    ```sh wrap theme={null}
    helm upgrade astro-agent astronomer/astro-remote-execution-agent -f values.yaml
    ```
  </Tab>
</Tabs>