ssm: support cross-account ssm get parameter

[pahud]

Describe the feature

If ssm parameter is created in Account A sharing with Account B through RAM. Account B would not be able to reference that using fromStringParameterAttributes. Only valueFromLookup would support.

Currently, CloudFormation doesn't support cross-account SSM parameter access.

This seems to be a blocker.

Use Case

cross-account ssm parameter referencing without lookup with SDK

Proposed Solution

I guess we have two options

1. allow fromStringParameterAttributes to accept an optional accountId parameter.
2. add a new fromStringParameterArn construct method

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.146.0

Environment details (OS name and version, etc.)

all

[pahud]

internal tracking: D140572316

[pahud]

Looks like it won't be possible until CFN supports cross-account parameter read.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[pahud]

related to #29292

[pahud]

OK I figured it out how to do that with CDK.

Assuming we have both Producer and Consumer accounts.

stack.ts

export class ParameterProducer extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);

    // create a ssm advanced parameter
    const ssmparam = new ssm.StringParameter(this, 'param', {
      parameterName: 'dummyName',
      tier: ssm.ParameterTier.ADVANCED,
      stringValue: 'dummyValue',
    }); 

    const consumerAccount = 'CONSUMER_ACCOUNT_ID';
    // create the resource share
    new ram.CfnResourceShare(this, 'resourceShare', {
      name: 'dummyName',
      allowExternalPrincipals: true,
      principals: [ consumerAccount ],
      resourceArns: [ ssmparam.parameterArn ],
    });

    new CfnOutput(this, 'producedParamArn', { value: ssmparam.parameterArn})

  }
}


export class ParameterStringCrossAccount {
  static fromArn(scope: Construct, id: string, arn: string): string {
    const cfnparam = new CfnParameter(scope, id, {
      type: 'AWS::SSM::Parameter::Value<String>',
      default: arn,
    });

    return cfnparam.valueAsString;
  }
}

export class DummyStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);

    // build the ARN of the parameter shared by the producer
    const xaccountParameterArn = Stack.of(this).formatArn({
      service: 'ssm',
      region: 'us-east-1',
      account: 'PRODUCER_ACCOUNT_ID',
      resource: 'parameter',
      resourceName: 'dummyName',
    });
    const remoteValue = ParameterStringCrossAccount.fromArn(this, 'remote-value', xaccountParameterArn)
    new CfnOutput(this, 'param-value', { value: remoteValue });
  }
}

app.ts

const producerEnv = { region: 'us-east-1', account: 'PRODUCER_ACCOUNT_ID' };

const consumerEnv ={ region: process.env.CDK_DEFAULT_REGION, account: process.env.CDK_DEFAULT_ACCOUNT };

new ParameterProducer(app, 'ParameterProducer', { env: producerEnv });
new DummyStack(app, 'dummy-stack', { env: consumerEnv });

Now, deploy the ParameterProducer stack using Producer account:

$ AWS_PROFILE=producer npx cdk deploy ParameterProducer 

You need to accept the sharing invitation from the RAM console of the Consumer account. This can not be done with CDK at this moment.

Now, try to get that using AWS CLI from Consumer account

% aws ssm get-parameter --name arn:aws:ssm:us-east-1:PRODUCER_ACCOUNT_ID:parameter/dummyName
{
    "Parameter": {
        "Name": "dummyName",
        "Type": "String",
        "Value": "dummyValue",
        "Version": 1,
        "LastModifiedDate": "2024-06-21T13:53:23.347000-04:00",
        "ARN": "arn:aws:ssm:us-east-1:PRODUCER_ACCOUNT_ID:parameter/dummyName",
        "DataType": "text"
    }
}

It works!

Now, deploy the consumer stack using consumer account:

$ npx cdk deploy dummy-stack

You should see the value returned:

Outputs:
dummy-stack.paramvalue = dummyValue

[aws-cdk-automation]

Comments on closed issues and PRs are hard for our team to see. If you need help, please open a new issue that references this one.

[pahud]

Update: cross-account SSM Parameters sharing is supported now. Check the doc for more details about the fromStringParameterArn() method.

If you need to know about SSM in AWS CDK, feel free to reference this blog post - SSM Parameters in AWS CDK from community.aws.