Store secrets in SSM Parameter Store instead of Secrets Manager (breaking)

Package.swift

@@ -41,7 +41,7 @@ let package = Package(
             dependencies: [
                 .product(name: "ArgumentParser", package: "swift-argument-parser"),
                 .product(name: "Logging", package: "swift-log"),
-                .product(name: "SotoSecretsManager", package: "soto"),
+                .product(name: "SotoSSM", package: "soto"),
                 .product(name: "SRP", package: "swift-srp"),
                 .product(name: "Noora", package: "Noora"),
                 .product(name: "_CryptoExtras", package: "swift-crypto"),

Sources/xcodeinstall/CLI-driver/CLIAuthenticate.swift

@@ -34,7 +34,7 @@ extension MainCommand {
 
             let xci = try await MainCommand.makeXCodeInstall(
                 with: deps,
-                for: cloudOption.secretManagerRegion,
+                for: cloudOption.secretRegion,
                 profileName: cloudOption.profileName,
                 verbose: globalOptions.verbose
             )
@@ -59,7 +59,7 @@ extension MainCommand {
 
             let xci = try await MainCommand.makeXCodeInstall(
                 with: deps,
-                for: cloudOption.secretManagerRegion,
+                for: cloudOption.secretRegion,
                 profileName: cloudOption.profileName,
                 verbose: globalOptions.verbose
             )

Sources/xcodeinstall/CLI-driver/CLIDownload.swift

@@ -39,7 +39,7 @@ extension MainCommand {
         func run(with deps: AppDependencies?) async throws {
             let xci = try await MainCommand.makeXCodeInstall(
                 with: deps,
-                for: cloudOption.secretManagerRegion,
+                for: cloudOption.secretRegion,
                 profileName: cloudOption.profileName,
                 verbose: globalOptions.verbose
             )

Sources/xcodeinstall/CLI-driver/CLIList.swift

@@ -65,7 +65,7 @@ extension MainCommand {
         func run(with deps: AppDependencies?) async throws {
             let xci = try await MainCommand.makeXCodeInstall(
                 with: deps,
-                for: cloudOption.secretManagerRegion,
+                for: cloudOption.secretRegion,
                 profileName: cloudOption.profileName,
                 verbose: globalOptions.verbose
             )

Sources/xcodeinstall/CLI-driver/CLIMain.swift

@@ -33,10 +33,10 @@ struct MainCommand: AsyncParsableCommand {
     struct CloudOptions: ParsableArguments {
 
         @Option(
-            name: [.customLong("secretmanager-region"), .short],
-            help: "Instructs to use AWS Secrets Manager to store and read secrets in the given AWS Region"
+            name: [.customLong("secret-region"), .short],
+            help: "Instructs to store and read secrets on AWS in the given AWS Region"
         )
-        var secretManagerRegion: String?
+        var secretRegion: String?
 
         @Option(
             name: [.customLong("profile"), .customShort("p")],
@@ -102,7 +102,7 @@ struct MainCommand: AsyncParsableCommand {
         let urlSession = URLSession.shared
 
         let secrets: SecretsHandlerProtocol
-        if let effectiveRegion = resolved.secretManagerRegion {
+        if let effectiveRegion = resolved.secretRegion {
             secrets = try await SecretsStorageAWS(
                 region: effectiveRegion,
                 profileName: resolved.profileName,

Sources/xcodeinstall/CLI-driver/CLIStoreSecrets.swift

@@ -20,17 +20,17 @@ extension MainCommand {
         nonisolated static let configuration =
             CommandConfiguration(
                 commandName: "storesecrets",
-                abstract: "Store your Apple Developer Portal username and password in AWS Secrets Manager"
+                abstract: "Store your Apple Developer Portal username and password in AWS Parameter Store"
             )
 
         @OptionGroup var globalOptions: GlobalOptions
 
         // repeat of CloudOption but this time mandatory
         @Option(
-            name: [.customLong("secretmanager-region"), .short],
-            help: "Instructs to use AWS Secrets Manager to store and read secrets in the given AWS Region"
+            name: [.customLong("secret-region"), .short],
+            help: "Instructs to store and read secrets on AWS in the given AWS Region"
         )
-        var secretManagerRegion: String
+        var secretRegion: String
 
         @Option(
             name: [.customLong("profile"), .customShort("p")],
@@ -45,7 +45,7 @@ extension MainCommand {
         func run(with deps: AppDependencies?) async throws {
             let xci = try await MainCommand.makeXCodeInstall(
                 with: deps,
-                for: secretManagerRegion,
+                for: secretRegion,
                 profileName: profileName,
                 verbose: globalOptions.verbose
             )

Sources/xcodeinstall/CLI/CredentialPrompt.swift

@@ -0,0 +1,79 @@
+//
+//  CredentialPrompt.swift
+//  xcodeinstall
+//
+//  Shared helper that prompts for Apple ID credentials.
+//  Used by both `storesecrets` and `authenticate` flows.
+//
+
+#if canImport(FoundationEssentials)
+import FoundationEssentials
+#else
+import Foundation
+#endif
+
+/// Context message shown before prompting for credentials.
+enum CredentialPromptContext {
+    /// Credentials will be stored in AWS Parameter Store.
+    case storingToAWS
+    /// One-time interactive use (not stored remotely).
+    case interactive
+}
+
+/// Prompts the user for Apple ID username and password, displaying an appropriate
+/// context message based on the intended use.
+///
+/// - Parameters:
+///   - context: Determines the introductory message shown to the user.
+///   - display: The display backend for output.
+///   - readLine: The readline backend for input.
+/// - Returns: The captured credentials.
+/// - Throws: `CLIError.invalidInput` if the user provides no input.
+@MainActor
+func promptForAppleCredentials(
+    context: CredentialPromptContext,
+    display: DisplayProtocol,
+    readLine: ReadLineProtocol
+) throws -> AppleCredentialsSecret {
+
+    switch context {
+    case .storingToAWS:
+        display.display(
+            """
+            Your Apple ID credentials will be securely stored in AWS Parameter Store
+            for future authentication.
+            """,
+            style: .security
+        )
+    case .interactive:
+        display.display(
+            """
+            We prompt you for your Apple ID username, password, and two factors authentication code.
+            These values are not stored anywhere. They are used to get an Apple session ID.
+
+            Alternatively, you may store your credentials on AWS Parameter Store
+            """,
+            style: .security
+        )
+    }
+
+    guard
+        let username = readLine.readLine(
+            prompt: "Enter your Apple ID username: ",
+            silent: false
+        )
+    else {
+        throw CLIError.invalidInput
+    }
+
+    guard
+        let password = readLine.readLine(
+            prompt: "Enter your Apple ID password: ",
+            silent: true
+        )
+    else {
+        throw CLIError.invalidInput
+    }
+
+    return AppleCredentialsSecret(username: username, password: password)
+}

Sources/xcodeinstall/Secrets/SecretsHandler.swift

@@ -28,7 +28,7 @@ enum SecretsStorageError: Error, LocalizedError {
     }
 }
 
-// the data to be stored in Secrets Manager as JSON
+// the data to be stored in Parameter Store as JSON
 struct AppleCredentialsSecret: Codable, Secrets {
 
     let username: String