Configuration, secrets, and credentials

Configuration concepts separate deploy-time values, runtime environment variables, secrets, and credential requirements from application logic.

Source: mde/metamodels/pim/pim-config.emf.

`ConfigurationSet`

Represents configuration set in the PIM vocabulary. It specializes TraceableElement, DeployableElement, PolicyTarget, ConfigurableElement with the details needed for this modeling concern.

Direct supertypes: TraceableElement, DeployableElement, PolicyTarget, ConfigurableElement. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
`scope`	`ConfigScope` [1]	Stores the boundary within which scope is interpreted on the configuration set. The field records isolation and ownership decisions as an explicit, reviewable input. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	Exactly one of: `APPLICATION`, `SERVICE`, `FUNCTION`, `ENVIRONMENT`, `DEPLOYMENT_UNIT`. Example: `APPLICATION`.

Relationships

Relationship	Kind and multiplicity	Meaning in the model
`parameters` → `ConfigParameter`	containment, [*]; opposite `configurationSet`	Contains the config parameter element(s) that make up this configuration set; the contained objects belong to this model element.
`environmentVariables` → `EnvironmentVariable`	containment, [*]; opposite `configurationSet`	Contains the environment variable element(s) that make up this configuration set; the contained objects belong to this model element.
`environments` → `EnvironmentTarget`	reference, [*]	References the environment target element(s) used as environments by this configuration set; the target may be shared elsewhere in the model.
`appliesTo` → `ConfigurableElement`	reference, [*]	References the configurable element element(s) used as applies to by this configuration set; the target may be shared elsewhere in the model.

`ConfigParameter`

Represents config parameter in the PIM vocabulary. It specializes TraceableElement with the details needed for this modeling concern.

Direct supertypes: TraceableElement. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
`scope`	`ConfigScope` [1]	Records boundary within which scope is interpreted for config parameter. It keeps isolation and ownership decisions explicit during review and transformation, so later steps do not have to infer it. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	Exactly one of: `APPLICATION`, `SERVICE`, `FUNCTION`, `ENVIRONMENT`, `DEPLOYMENT_UNIT`. Example: `APPLICATION`.
`valueKind`	`String` [1]	Stores the controlled classification or strategy represented by value kind on the config parameter. The field keeps the model explicit and reviewable during review and transformation instead of leaving the decision to an inferred default. Transformation role: ETL rule `ConfigParameter2CfnParameter` in `mde/transformations/pim-to-awspsm/workflow-security-config.etl` assigns or materializes this feature while refining `ConfigParameter`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `READY`.
`defaultValue`	`String` [1]	Records the default value value for config parameter. It keeps this decision explicit during review and transformation, so later steps do not have to infer it. Semantic validation: `RequiredParameterShouldHaveDefaultOrStageSpecificDecision` (required parameter should have default or stage specific decision) in `mde/validation/pim/rules/security-config-external.evl` the value must be present and non-blank. Transformation role: ETL rule `ConfigParameter2CfnParameter` in `mde/transformations/pim-to-awspsm/workflow-security-config.etl` reads or derives this feature while refining `ConfigParameter`. ETL rule `ConfigParameter2CfnParameter` in `mde/transformations/pim-to-awspsm/workflow-security-config.etl` assigns or materializes this feature while refining `ConfigParameter`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `READY`.
`stageSpecific`	`Boolean` [1]	Records whether stage specific applies to config parameter. It preserves an explicit architectural or governance decision through review and transformation, so later steps do not have to infer it. Semantic validation: `RequiredParameterShouldHaveDefaultOrStageSpecificDecision` (required parameter should have default or stage specific decision) in `mde/validation/pim/rules/security-config-external.evl` the value must be present and non-blank.	Either `true` or `false`. Example: `false`.
`secret`	`Boolean` [1]	Records whether secret applies to config parameter. It preserves an explicit architectural or governance decision through review and transformation, so later steps do not have to infer it. Semantic validation: `RequiredParameterShouldHaveDefaultOrStageSpecificDecision` (required parameter should have default or stage specific decision) in `mde/validation/pim/rules/security-config-external.evl` the value must be present and non-blank. Transformation role: ETL rule `ConfigParameter2CfnParameter` in `mde/transformations/pim-to-awspsm/workflow-security-config.etl` reads or derives this feature while refining `ConfigParameter`. ETL rule `SecretConfigParameter2SsmParameter` in `mde/transformations/pim-to-awspsm/workflow-security-config.etl` reads or derives this feature while refining `ConfigParameter`. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`. The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/validation.eol`.	Either `true` or `false`. Example: `false`.
`required`	`Boolean` [1]	For a config parameter, the model records whether required applies. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. Semantic validation: `RequiredParameterShouldHaveDefaultOrStageSpecificDecision` (required parameter should have default or stage specific decision) in `mde/validation/pim/rules/security-config-external.evl` the feature participates in a semantic validation condition. Transformation role: ETL rule `SecretConfigParameter2SsmParameter` in `mde/transformations/pim-to-awspsm/workflow-security-config.etl` reads or derives this feature while refining `ConfigParameter`.	Either `true` or `false`. Example: `true`.
`validationPattern`	`String` [1]	For a config parameter, the model records the validation pattern for validation pattern. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. Transformation role: ETL rule `ConfigParameter2CfnParameter` in `mde/transformations/pim-to-awspsm/workflow-security-config.etl` assigns or materializes this feature while refining `ConfigParameter`. ETL rule `SecretConfigParameter2SsmParameter` in `mde/transformations/pim-to-awspsm/workflow-security-config.etl` assigns or materializes this feature while refining `ConfigParameter`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `^[A-Z][A-Za-z0-9_-]*$`.

Relationships

Relationship	Kind and multiplicity	Meaning in the model
`configurationSet` → `ConfigurationSet`	reference; read-only, [1]; opposite `parameters`	References the configuration set element(s) used as configuration set by this config parameter; the target may be shared elsewhere in the model.

`EnvironmentVariable`

Represents environment variable in the PIM vocabulary. It specializes TraceableElement with the details needed for this modeling concern.

Direct supertypes: TraceableElement. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
`variableName`	`String` [1]	Stores the stable name/key/code used for variable name on the environment variable. The field keeps the model explicit and reviewable during review and transformation instead of leaving the decision to an inferred default. Semantic validation: `SecretEnvironmentVariableReferencesSecret` (secret environment variable references secret) in `mde/validation/pim/rules/security-config-external.evl` the rule's diagnostic or remediation guidance refers to this feature. `EnvironmentVariableNameIsPortable` (environment variable name is portable) in `mde/validation/pim/rules/security-config-external.evl` the value must be present and non-blank. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `EnvironmentVariableExample`.
`valueSource`	`String` [1]	Records origin/source selected for value source for environment variable. It keeps this decision explicit during review and transformation, so later steps do not have to infer it. Semantic validation: `SecretNotPlainEnvironmentValue` (secret not plain environment value) in `mde/validation/pim/rules/security-config-external.evl` the value must be present and non-blank.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `READY`.
`secretReference`	`Boolean` [1]	For a environment variable, the model records whether secret reference applies. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. Semantic validation: `SecretEnvironmentVariableReferencesSecret` (secret environment variable references secret) in `mde/validation/pim/rules/security-config-external.evl` the feature participates in a semantic validation condition. `SecretNotPlainEnvironmentValue` (secret not plain environment value) in `mde/validation/pim/rules/security-config-external.evl` the feature participates in a semantic validation condition.	Either `true` or `false`. Example: `false`.

Relationships

Relationship	Kind and multiplicity	Meaning in the model
`configurationSet` → `ConfigurationSet`	reference; read-only, [1]; opposite `environmentVariables`	References the configuration set element(s) used as configuration set by this environment variable; the target may be shared elsewhere in the model.
`parameter` → `ConfigParameter`	reference, [?]	References the config parameter element(s) used as parameter by this environment variable; the target may be shared elsewhere in the model.
`secret` → `Secret`	reference, [?]	References the secret element(s) used as secret by this environment variable; the target may be shared elsewhere in the model.

`Secret`

Represents secret in the PIM vocabulary. It specializes TraceableElement, ProtectedResource, PolicyTarget with the details needed for this modeling concern.

Direct supertypes: TraceableElement, ProtectedResource, PolicyTarget. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
`rotationRequired`	`Boolean` [1]	Records whether rotation required applies to secret. This keeps the decision explicit even when the element's class or relationships remain unchanged. Semantic validation: `RotationRequiredNeedsFrequency` (rotation required needs frequency) in `mde/validation/pim/rules/security-config-external.evl` the feature participates in a semantic validation condition. Transformation role: ETL rule `Secret2SecretsManagerSecret` in `mde/transformations/pim-to-awspsm/workflow-security-config.etl` assigns or materializes this feature while refining `Secret`.	Either `true` or `false`. Example: `true`.
`rotationFrequency`	`String` [1]	For a secret, the model records the rotation frequency value. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. Semantic validation: `RotationRequiredNeedsFrequency` (rotation required needs frequency) in `mde/validation/pim/rules/security-config-external.evl` the value must be present and non-blank. Transformation role: ETL rule `Secret2SecretsManagerSecret` in `mde/transformations/pim-to-awspsm/workflow-security-config.etl` assigns or materializes this feature while refining `Secret`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `PT5M`.
`generatedReferenceOnly`	`Boolean` [1]	Records whether generated reference only applies to secret. The field records an explicit architectural or governance decision as an explicit, reviewable input. Semantic validation: `SecretReferenceOnly` (secret reference only) in `mde/validation/pim/rules/security-config-external.evl` the feature participates in a semantic validation condition. Transformation role: ETL rule `Secret2SecretsManagerSecret` in `mde/transformations/pim-to-awspsm/workflow-security-config.etl` reads or derives this feature while refining `Secret`.	Either `true` or `false`. Example: `false`.
`environmentSpecific`	`Boolean` [1]	Records whether environment specific applies to secret. It preserves an explicit architectural or governance decision through review and transformation, so later steps do not have to infer it. Semantic validation: `EnvironmentSpecificSecretShouldHaveOwner` (environment specific secret should have owner) in `mde/validation/pim/rules/security-config-external.evl` the feature participates in a semantic validation condition.	Either `true` or `false`. Example: `false`.
`ownerTeam`	`String` [1]	For a secret, the model records the accountable person, team, or identity for owner team. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. Semantic validation: `EnvironmentSpecificSecretShouldHaveOwner` (environment specific secret should have owner) in `mde/validation/pim/rules/security-config-external.evl` the value must be present and non-blank.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `orders-team`.
`secretKind`	`SecretKind` [1]	Stores the controlled classification or strategy represented by secret kind on the secret. The field keeps the model explicit and reviewable during review and transformation instead of leaving the decision to an inferred default. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	Exactly one of: `API_KEY`, `PASSWORD`, `TOKEN`, `CERTIFICATE`, `CONNECTION_STRING`, `PRIVATE_KEY`, `OTHER`. Example: `API_KEY`.

Relationships

Relationship	Kind and multiplicity	Meaning in the model
`usedForCredentials` → `CredentialRequirement`	reference, [*]; opposite `secret`	References the credential requirement element(s) used as used for credentials by this secret; the target may be shared elsewhere in the model.

`CredentialRequirement`

Represents credential requirement in the PIM vocabulary. It specializes TraceableElement, CredentialRequirementLike with the details needed for this modeling concern.

Direct supertypes: TraceableElement, CredentialRequirementLike. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
`purpose`	`String` [1]	Stores the human explanation of purpose on the credential requirement. The field keeps the model explicit and reviewable during review and transformation instead of leaving the decision to an inferred default. Semantic validation: `CredentialRequirementHasSecret` (credential requirement has secret) in `mde/validation/pim/rules/security-config-external.evl` the feature participates in a semantic validation condition. `CredentialRequirementShouldExplainPurpose` (credential requirement should explain purpose) in `mde/validation/pim/rules/security-config-external.evl` the value must be present and non-blank.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `Reserve inventory for a confirmed order.`.
`rotationRequired`	`Boolean` [1]	Records whether rotation required applies to credential requirement. It preserves an explicit architectural or governance decision through review and transformation, so later steps do not have to infer it. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	Either `true` or `false`. Example: `true`.
`rotationFrequency`	`String` [1]	Stores the rotation frequency value on the credential requirement. The field keeps the model explicit and reviewable during review and transformation instead of leaving the decision to an inferred default. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `PT5M`.
`sharedAcrossEnvironments`	`Boolean` [1]	Records whether shared across environments applies to credential requirement. The field records an explicit architectural or governance decision as an explicit, reviewable input. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	Either `true` or `false`. Example: `false`.
`secretKind`	`SecretKind` [1]	For a credential requirement, the model records the controlled classification or strategy represented by secret kind. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	Exactly one of: `API_KEY`, `PASSWORD`, `TOKEN`, `CERTIFICATE`, `CONNECTION_STRING`, `PRIVATE_KEY`, `OTHER`. Example: `API_KEY`.

Relationships

Relationship	Kind and multiplicity	Meaning in the model
`secret` → `Secret`	reference, [?]; opposite `usedForCredentials`	References the secret element(s) used as secret by this credential requirement; the target may be shared elsewhere in the model.