# Push Actions

## Overview

CloudTruth push actions allow you to write secrets to an external integration from specified projects. This allows you to keep existing workflows and obtain the centralized data management CloudTruth provides.

| Push Action Supported Integrations | Types                |
| ---------------------------------- | -------------------- |
| AWS Parameter store (SSM)          | String; SecureString |
| AWS Secrets Store                  | Secret               |

Configuring a push action requires three prerequisites that work together to form the base of what you will be sending to the external source.

1. A CloudTruth [AWS Integration](/configuration-management/integrations/aws.md) created with Write Access in your organization.
2. [Parameters](/configuration-management/parameters/parameter-management/managing-parameters.md#adding-an-internal-parameter-value) or secrets created within a [project](/configuration-management/projects.md#creating-projects).
3. [Tags](/configuration-management/environments.md#tagging) created in an environment which act as a trigger for push.

The Actions page will walk you through creating an integration of tag if they do not exist.

![](/files/y3ZaUAOIPqX2SYyGXoem)

The list will dynamically change depending on what is setup in your organization and the project selected. This project has at least one parameter or secret and a tag exists within an environment. Therefore, the Actions page only displays a shortcut to create an AWS integration.

![](/files/rWuowyXUyPoG8SU4WWAb)

### Creating a Push Action

From the Actions Push page, click `Create Push`.

1. Provide the action a name and a tag from your selected environments.
2. Select a project(s) that contain parameters and secrets to be pushed.
3. Select a configured integration, the region to push to and the destination service
4. Check the options desired:
   * `DRY RUN`: when the push action executes, it only reports the upstream changes it would perform without actually performing them
   * `FORCE`: By default, PUSH will not overwrite any upstream items if it didn't create it. Turning `FORCE` on allows CloudTruth to take ownership and overwrite any pre-existing items
   * `LOCAL`: By default, PUSH will include all parameters inherited from parent projects. Turning `LOCAL` on will cause it to only send the parameters defined directly in the given projects
   * The destination type automatically determines which of parameters and secrets are pushed to it, override the default with:
     * `PARAMETERS`: Include parameters (non-secrets) when pushing
     * `SECRETS`: Include secrets when pushing
     * `COERCE`: Include secrets/parameters even if the upstream destination doesn't allow them (e.g. non-secrets in AWS SecretsManager)
5. Click `Next`.

![](/files/JGfhiZ9Weytk9SQXFopH)

You can now build the name and structure of the parameters that are being pushed.

![](/files/Mp4nVnXY7Y8o4FiHYrJb)

{% hint style="info" %}
When creating a resource name the string and selected template components must conform to the services naming conventions.

{{parameter}} name is a required component of the Resource Name.
{% endhint %}

Preview the action and click `Create Action`.

![](/files/g2EEEyB7opJlYQPp13qG)

The created action is now displayed on the Actions page for the selected project(s).

![](/files/z1G8Lpy4VAK7xhRN2v6N)

Action information is also associated with the selected integration. The integration actions table displays all actions associated with the integration across all projects.

![](/files/zxLGN1buxZFFAQ7hhAQB)

#### **Push action details**

Click on an action from the Push Actions page to get detailed information and tasks. Tasks are expandable and display the evaluated resource name that is used for the created secret in the selected integration service. If an action fails you will find detailed logging in the Tasks table.

![](/files/1yZwnCKBkTwwzMMB4ySB)

{% hint style="info" %}
The Push action only writes CloudTruth Secrets to AWS Secrets Manager.
{% endhint %}

#### Action Triggers

[Environment Tags](/configuration-management/environments.md#tagging) serve as triggers for a push action. The initial sync uses secrets and values that are associated with the selected tag when an action is created.

Updating a tag to the latest time, or even a previous time, will initiate a new sync on any actions that are triggered by the updated tag. This effectively provides your external sources a sync point with a projects parameters associated with a specified tag.

Actions can contain multiple tags but are limited to a single tag per environment.

### Managing Actions

You can edit, initiate a sync, or delete an action from any of the actions tables or on the detailed action page with the menu button.

![](/files/lt2G2w8TB15PgrEVMwuW)

#### Editing an action

You can edit the name of an action, description, project(s), Resource Name and change the Tag that triggers the push.

![](/files/7oto4YdXLKokzr3YB2Nd)

{% hint style="warning" %}
Removing, adding or updating an associated Actions tag will trigger an update to external sources. The secrets and values will be updated or removed based on the removed, added or updated tags.
{% endhint %}

#### Syncing an action

You can perform a manual sync from the action menu. This is useful if the action fails for connectivity or setup issues to the external source.

#### Deleting an action

Deleting an action will remove all parameters and secrets stored in the external integration source.

#### Unsupported parameter types

[External ](/configuration-management/parameters/parameter-management/external-values.md)and [Dynamic ](/configuration-management/parameters/parameter-management/managing-parameters.md#dynamic-parameters)parameter values will fail to be pushed to selected services.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.cloudtruth.com/configuration-management/actions/push-actions.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.