Push Actions

Overview
CloudTruth push actions allow you to write secrets to an external integration from specified projects. This allows you to keep existing workflows and obtain the centralized data management CloudTruth provides.
Push Action Supported Integrations
Types
AWS Parameter store (SSM)
String; SecureString
AWS Secrets Store
Secret
Configuring a push action requires three prerequisites that work together to form the base of what you will be sending to the external source.
1.A CloudTruth AWS Integration created with Write Access in your organization.
2.​Parameters or secrets created within a project.
3.​Tags created in an environment which act as a trigger for push.
The Actions page will walk you through creating an integration of tag if they do not exist.
The list will dynamically change depending on what is setup in your organization and the project selected. This project has at least one parameter or secret and a tag exists within an environment. Therefore, the Actions page only displays a shortcut to create an AWS integration.
Creating a Push Action
From the Actions Push page, click Create Push.
1.Provide the action a name and a tag from your selected environments.
2.Select a project(s) that contain parameters and secrets to be pushed.
3.Select a configured integration, the region to push to and the destination service
4.Check the options desired:
DRY RUN: when the push action executes, it only reports the upstream changes it would perform without actually performing them
FORCE: By default, PUSH will not overwrite any upstream items if it didn't create it. Turning FORCE on allows CloudTruth to take ownership and overwrite any pre-existing items
LOCAL: By default, PUSH will include all parameters inherited from parent projects. Turning LOCAL on will cause it to only send the parameters defined directly in the given projects
The destination type automatically determines which of parameters and secrets are pushed to it, override the default with:
PARAMETERS: Include parameters (non-secrets) when pushing
SECRETS: Include secrets when pushing
COERCE: Include secrets/parameters even if the upstream destination doesn't allow them (e.g. non-secrets in AWS SecretsManager)
5.Click Next.
You can now build the name and structure of the parameters that are being pushed.
When creating a resource name the string and selected template components must conform to the services naming conventions.
{{parameter}} name is a required component of the Resource Name.
Preview the action and click Create Action.
The created action is now displayed on the Actions page for the selected project(s).
Action information is also associated with the selected integration. The integration actions table displays all actions associated with the integration across all projects.
Push action details
Click on an action from the Push Actions page to get detailed information and tasks. Tasks are expandable and display the evaluated resource name that is used for the created secret in the selected integration service. If an action fails you will find detailed logging in the Tasks table.
The Push action only writes CloudTruth Secrets to AWS Secrets Manager.
Action Triggers
​Environment Tags serve as triggers for a push action. The initial sync uses secrets and values that are associated with the selected tag when an action is created.
Updating a tag to the latest time, or even a previous time, will initiate a new sync on any actions that are triggered by the updated tag. This effectively provides your external sources a sync point with a projects parameters associated with a specified tag.
Actions can contain multiple tags but are limited to a single tag per environment.
Managing Actions
You can edit, initiate a sync, or delete an action from any of the actions tables or on the detailed action page with the menu button.
Editing an action
You can edit the name of an action, description, project(s), Resource Name and change the Tag that triggers the push.
Removing, adding or updating an associated Actions tag will trigger an update to external sources. The secrets and values will be updated or removed based on the removed, added or updated tags.
Syncing an action
You can perform a manual sync from the action menu. This is useful if the action fails for connectivity or setup issues to the external source.
Deleting an action
Deleting an action will remove all parameters and secrets stored in the external integration source.
Unsupported parameter types
​External and Dynamic parameter values will fail to be pushed to selected services.
Push Action Supported Integrations	Types
AWS Parameter store (SSM)	String; SecureString
AWS Secrets Store	Secret
Last modified 2mo ago