EXTENSIONS

A swamp vault on AWS Systems Manager Parameter Store. Every secret is a SecureString parameter, on the Standard tier, named by a prefix (default /swamp/) and the secret key. Credentials come from the AWS default chain or a named profile; an optional KMS key encrypts the values. get, put and delete refuse plaintext String parameters, delete is immediate, and errors never carry the value. Supports swamp vault read-secret, put, list-keys and delete.

AWS SSM infrastructure models