AWS CLI 2 · Containers and secrets
Read a parameter
Read a Systems Manager parameter and decrypt it if it is a SecureString.
aws ssm get-parameter --name /app/db-url --with-decryption --query Parameter.Value --output text
Caution: This prints the secret in your terminal.
Official AWS CLI 2 documentation