Get value from parameter store via code pipeline output '***' - amazon-web-services

Question

Base on AWS Code Build documentation, we can pass EnvironmentVariables with PARAMETER_STORE type.
I've ensure the parameter store name is typed correctly and the parameter is exists.
I've tried to login via aws cli but it seem not related and still get wrong result.
Here is my cloudformation yaml snippet:
- Name: Build
Actions:
- Name: HelloWord
ActionTypeId:
Category: Build
Owner: AWS
Provider: CodeBuild
Version: "1"
Configuration:
ProjectName: HelloWoldBuild
EnvironmentVariables:
Fn::Sub:
- '[{"name": "NGINX_BASE_IMAGE_TAG","value": "${NGINX_BASE_IMAGE_TAG}","type": "PARAMETER_STORE"}]
- NGINX_BASE_IMAGE_TAG: "/nginx/base"
and here is my buildspec.yaml snippet:
version: 0.2
phases:
install:
runtime-versions:
docker: 18
pre_build:
commands:
- echo "${NGINX_BASE_IMAGE_TAG}"
When I see the CodeBuild log, the output was '***'. The correct one should be value from my parameter store.
How could it happen ? I still don't get it. I've test with PLAINTEXT type and works well.

Answer 1

This is by design.
Values from parameter store are considers as sensitive.
So CodeBuild masks them so they don't appear in plain text in its logs.
To deal with that, you can assign it to different variable, and print that. The following would be my first try to deal with that:
pre_build:
commands:
- NEW_VAR=${NGINX_BASE_IMAGE_TAG}
- echo "${NEW_VAR}"
Alternative. Save it to file and print out a file:
pre_build:
commands:
- echo ${NGINX_BASE_IMAGE_TAG} > /tmp/test.value
- cat /tmp/test.value