Check existence and access of SSM parameters in multiple AWS environments

ssm-param-envs

#!/usr/bin/env bash

# Usage: ssm-param-envs /path/one /path/two ...

# Define the environments to iterate over
environments=("dev" "staging" "sandbox" "prod")

# Create a dynamic regex for sed substitution, escaping slashes
env_pattern="$(IFS='|'; echo "${environments[*]}")"
escaped_env_pattern="\\/(${env_pattern})\\/" # Example: \/(dev|staging|sandbox|prod)\/

# Loop through each user-provided parameter path
for input_path in "$@"; do
  # Strip /env_vars/ to get the canonical base path
  canonical_path=$(echo "$input_path" | sed -E 's|/env_vars||')

  # Display-friendly version
  display_path=$(echo "$canonical_path" | sed -E "s/${escaped_env_pattern}/\/{env}\//")
  echo "--- Parameter Template: $display_path ---"
  echo ""

  # Loop through each environment
  for target_env in "${environments[@]}"; do
    # Replace the env portion with the target
    non_namespaced_path=$(echo "$canonical_path" | sed -E "s/${escaped_env_pattern}/\/${target_env}\//")
    namespaced_path=$(echo "$non_namespaced_path" | sed -E "s|/(${target_env})/|/\1/env_vars/|")

    # Check: Direct (non-namespaced)
    status_non_ns="❌"
    error_output_non_ns=$(aws ssm get-parameter --name "$non_namespaced_path" --query Parameter.Name --output text 2>&1 >/dev/null)
    if [ $? -eq 0 ]; then
      status_non_ns="✅"
    elif [[ "$error_output_non_ns" == *"AccessDeniedException"* ]]; then
      status_non_ns="❓"
    fi

    # Check: Namespaced
    status_ns="❌"
    error_output_ns=$(aws ssm get-parameter --name "$namespaced_path" --query Parameter.Name --output text 2>&1 >/dev/null)
    if [ $? -eq 0 ]; then
      status_ns="✅"
    elif [[ "$error_output_ns" == *"AccessDeniedException"* ]]; then
      status_ns="❓"
    fi

    # Print results
    env_label="[$target_env]"
    printf "%s  %-10s  %-12s %s\n" "$status_non_ns" "$env_label" "Direct:" "$non_namespaced_path"
    printf "%s  %-10s  %-12s %s\n" "$status_ns"     "$env_label" "Namespaced:" "$namespaced_path"
  done

  echo ""
done

echo "--- All checks complete. ---"
echo "--- Legend: ✅ = exists | ❌ = does not exist | ❓ = access denied ---"