From d7ddc34dd70390465d62b504267e0385af81579f Mon Sep 17 00:00:00 2001
From: Daniel Bartholomae <daniel@bartholomae.name>
Date: Fri, 28 Jan 2022 22:23:25 +0100
Subject: [PATCH] fix(core): correctly reference versionless secure parameters

---
 packages/@aws-cdk/core/lib/secret-value.ts       | 5 +++--
 packages/@aws-cdk/core/test/secret-value.test.ts | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/packages/@aws-cdk/core/lib/secret-value.ts b/packages/@aws-cdk/core/lib/secret-value.ts
index 84e668a1b4306..760fef03e95c9 100644
--- a/packages/@aws-cdk/core/lib/secret-value.ts
+++ b/packages/@aws-cdk/core/lib/secret-value.ts
@@ -71,8 +71,9 @@ export class SecretValue extends Intrinsic {
    * latest version of the parameter.
    */
   public static ssmSecure(parameterName: string, version?: string): SecretValue {
-    const parts = [parameterName, version ?? ''];
-    return this.cfnDynamicReference(new CfnDynamicReference(CfnDynamicReferenceService.SSM_SECURE, parts.join(':')));
+    return this.cfnDynamicReference(
+        new CfnDynamicReference(CfnDynamicReferenceService.SSM_SECURE,
+            version ? `${parameterName}:${version}` : parameterName));
   }
 
   /**
diff --git a/packages/@aws-cdk/core/test/secret-value.test.ts b/packages/@aws-cdk/core/test/secret-value.test.ts
index a987cfaff0c87..4a9b7bbe56093 100644
--- a/packages/@aws-cdk/core/test/secret-value.test.ts
+++ b/packages/@aws-cdk/core/test/secret-value.test.ts
@@ -127,7 +127,7 @@ describe('secret value', () => {
     const v = SecretValue.ssmSecure('param-name');
 
     // THEN
-    expect(stack.resolve(v)).toEqual('{{resolve:ssm-secure:param-name:}}');
+    expect(stack.resolve(v)).toEqual('{{resolve:ssm-secure:param-name}}');
   });
 
   test('cfnDynamicReference', () => {