Multiline String in SAM Config TOML Parameter

Question

I have a TLS certificate and Key. It is PEM formatted. I am trying to import this certificate using SAM (subset of CloudFormation) into AWS Certificate Manager, referring the link. In the link, the Certificate and CertificateKey parameters are provided directly in the template.yaml. However, I want to pass these values from SAM Config TOML file. However, I am not sure how to pass a multiline string of a certificate via SAM Config TOML. Please help with some sample.

danjhd
6 months ago
I also just wanted to check that the private key you had included in that repo that you have linked to is not a valid private key? Or if it is i suggest you revoke it ASAP since it is now essentially in the public domain.

Accepted Answer

The best way is to use the multiline strings, """, around the outside of the parameter overrides.   So for example:

```
parameter_overrides = [
"""Certificate="-----BEGIN CERTIFICATE-----
My-cert-content
-----END CERTIFICATE-----"""",
"""CertificatePrivateKey="-----BEGIN PRIVATE KEY-----
My-key-content
-----END PRIVATE KEY-----""""
]
```
Note you still need to escape newlines to prevent them being inserted into the multiline string if they cause problems.

Answer

Multiline strings in TOML are similar to in Python: open with a triple double-quote """ and close with another; newlines inside will be kept. The initial new-line after the opening """ will be trimmed, or you can start the content immediately after it.

See the TOML spec for an example at https://toml.io/en/v1.0.0#string

Answer

To provide multi-line strings in the TOML file i would expect (not tested) that you just need to use `
` and escape them correctly in the strings within your TOML.
However, whilst this might allow you to solve what you are trying to do i would suggest it might be worth considering a different approach in this case as the string you are trying to pass is a certificate and therefore could be considered "sensitive data" so providing it in "clear text" in the TOML might not be a good idea.
May i suggest an alternative?
Create a new Secret within AWS Secrets Manager and store the certificate in there. Then in your template you can refer to the Secret instead of using a mutliline string like this.

Multiline String in SAM Config TOML Parameter

Relevant content