AWS Systems Manager Parameter Store: Hierarchical Config Coding Agents Must Not Hardcode

/prod/coding-agent/shared/bedrock_region = us-east-1
/prod/coding-agent/shared/audit_bucket = coding-agent-audit-prod
/prod/coding-agent/patcher/model_id = anthropic.claude-sonnet-4-20250514-v1:0
/prod/coding-agent/patcher/max_tool_hops = 8
/prod/coding-agent/patcher/prompt_version = 3
/prod/coding-agent/patcher/repos_allowlist = acme/payments,acme/billing
/prod/coding-agent/reviewer/model_id = anthropic.claude-sonnet-4-20250514-v1:0
/prod/coding-agent/reviewer/strict_mode = true
/staging/coding-agent/patcher/model_id = anthropic.claude-haiku-...

# ✅ put parameters (standard tier unless you need advanced throughput/patterns)
aws ssm put-parameter \
  --name /prod/coding-agent/patcher/model_id \
  --type String \
  --value "anthropic.claude-sonnet-4-20250514-v1:0" \
  --overwrite \
  --tags Key=workload,Value=coding-agent Key=env,Value=prod

aws ssm put-parameter \
  --name /prod/coding-agent/patcher/webhook_hmac \
  --type SecureString \
  --value "whsec_..." \
  --key-id alias/coding-agent-config \
  --overwrite

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadPatcherConfig",
      "Effect": "Allow",
      "Action": [
        "ssm:GetParameter",
        "ssm:GetParameters",
        "ssm:GetParametersByPath"
      ],
      "Resource": [
        "arn:aws:ssm:us-east-1:111122223333:parameter/prod/coding-agent/patcher/*",
        "arn:aws:ssm:us-east-1:111122223333:parameter/prod/coding-agent/shared/*"
      ]
    },
    {
      "Sid": "DecryptSecureString",
      "Effect": "Allow",
      "Action": ["kms:Decrypt"],
      "Resource": "arn:aws:kms:us-east-1:111122223333:key/your-key",
      "Condition": {
        "StringEquals": {
          "kms:ViaService": "ssm.us-east-1.amazonaws.com"
        }
      }
    },
    {
      "Sid": "DenyOtherEnvs",
      "Effect": "Deny",
      "Action": ["ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath"],
      "Resource": "arn:aws:ssm:us-east-1:111122223333:parameter/staging/*"
    }
  ]
}

# ✅ load hierarchy once per process; refresh on TTL or SIGHUP
import time, boto3
from typing import Any

ssm = boto3.client("ssm")

class AgentConfig:
    def __init__(self, path: str, ttl_sec: int = 60):
        self.path = path.rstrip("/")
        self.ttl = ttl_sec
        self._data: dict[str, Any] = {}
        self._loaded_at = 0.0

    def refresh(self) -> None:
        paginator = ssm.get_paginator("get_parameters_by_path")
        data = {}
        for page in paginator.paginate(Path=self.path, Recursive=True, WithDecryption=True):
            for p in page["Parameters"]:
                key = p["Name"][len(self.path) + 1 :]  # relative
                data[key] = p["Value"]
        self._data = data
        self._loaded_at = time.time()

    def get(self, key: str, default: str | None = None) -> str | None:
        if time.time() - self._loaded_at > self.ttl:
            self.refresh()
        return self._data.get(key, default)

cfg = AgentConfig("/prod/coding-agent/patcher")
model = cfg.get("model_id")
max_hops = int(cfg.get("max_tool_hops", "6"))
# ❌ MODEL_ID = "anthropic.claude-..." hardcoded in source

# ✅ detect drift: required keys present
required="model_id max_tool_hops prompt_version repos_allowlist"
for k in $required; do
  aws ssm get-parameter --name "/prod/coding-agent/patcher/$k" >/dev/null || echo "MISSING $k"
done