Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ssm: support cross-account ssm get parameter #30603

Closed
2 tasks
pahud opened this issue Jun 20, 2024 · 7 comments
Closed
2 tasks

ssm: support cross-account ssm get parameter #30603

pahud opened this issue Jun 20, 2024 · 7 comments
Labels
@aws-cdk/aws-ssm Related to AWS Systems Manager effort/medium Medium work item – several days of effort feature-request A feature should be added or improved. p2

Comments

@pahud
Copy link
Contributor

pahud commented Jun 20, 2024

Describe the feature

If ssm parameter is created in Account A sharing with Account B through RAM. Account B would not be able to reference that using fromStringParameterAttributes. Only valueFromLookup would support.

Currently, CloudFormation doesn't support cross-account SSM parameter access.

This seems to be a blocker.

Use Case

cross-account ssm parameter referencing without lookup with SDK

Proposed Solution

I guess we have two options

  1. allow fromStringParameterAttributes to accept an optional accountId parameter.
  2. add a new fromStringParameterArn construct method

Other Information

No response

Acknowledgements

  • I may be able to implement this feature request
  • This feature might incur a breaking change

CDK version used

2.146.0

Environment details (OS name and version, etc.)

all

@pahud pahud added feature-request A feature should be added or improved. needs-triage This issue or PR still needs to be triaged. p2 effort/medium Medium work item – several days of effort @aws-cdk/aws-ssm Related to AWS Systems Manager and removed needs-triage This issue or PR still needs to be triaged. labels Jun 20, 2024
@pahud
Copy link
Contributor Author

pahud commented Jun 20, 2024

internal tracking: D140572316

@pahud
Copy link
Contributor Author

pahud commented Jun 20, 2024

Looks like it won't be possible until CFN supports cross-account parameter read.

@pahud pahud closed this as completed Jun 20, 2024
Copy link

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

@pahud
Copy link
Contributor Author

pahud commented Jun 21, 2024

related to #29292

@pahud
Copy link
Contributor Author

pahud commented Jun 21, 2024

OK I figured it out how to do that with CDK.

Assuming we have both Producer and Consumer accounts.

stack.ts

export class ParameterProducer extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);

    // create a ssm advanced parameter
    const ssmparam = new ssm.StringParameter(this, 'param', {
      parameterName: 'dummyName',
      tier: ssm.ParameterTier.ADVANCED,
      stringValue: 'dummyValue',
    }); 

    const consumerAccount = 'CONSUMER_ACCOUNT_ID';
    // create the resource share
    new ram.CfnResourceShare(this, 'resourceShare', {
      name: 'dummyName',
      allowExternalPrincipals: true,
      principals: [ consumerAccount ],
      resourceArns: [ ssmparam.parameterArn ],
    });

    new CfnOutput(this, 'producedParamArn', { value: ssmparam.parameterArn})

  }
}


export class ParameterStringCrossAccount {
  static fromArn(scope: Construct, id: string, arn: string): string {
    const cfnparam = new CfnParameter(scope, id, {
      type: 'AWS::SSM::Parameter::Value<String>',
      default: arn,
    });

    return cfnparam.valueAsString;
  }
}

export class DummyStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);

    // build the ARN of the parameter shared by the producer
    const xaccountParameterArn = Stack.of(this).formatArn({
      service: 'ssm',
      region: 'us-east-1',
      account: 'PRODUCER_ACCOUNT_ID',
      resource: 'parameter',
      resourceName: 'dummyName',
    });
    const remoteValue = ParameterStringCrossAccount.fromArn(this, 'remote-value', xaccountParameterArn)
    new CfnOutput(this, 'param-value', { value: remoteValue });
  }
}

app.ts

const producerEnv = { region: 'us-east-1', account: 'PRODUCER_ACCOUNT_ID' };

const consumerEnv ={ region: process.env.CDK_DEFAULT_REGION, account: process.env.CDK_DEFAULT_ACCOUNT };

new ParameterProducer(app, 'ParameterProducer', { env: producerEnv });
new DummyStack(app, 'dummy-stack', { env: consumerEnv });

Now, deploy the ParameterProducer stack using Producer account:

$ AWS_PROFILE=producer npx cdk deploy ParameterProducer 

You need to accept the sharing invitation from the RAM console of the Consumer account. This can not be done with CDK at this moment.

Now, try to get that using AWS CLI from Consumer account

% aws ssm get-parameter --name arn:aws:ssm:us-east-1:PRODUCER_ACCOUNT_ID:parameter/dummyName
{
    "Parameter": {
        "Name": "dummyName",
        "Type": "String",
        "Value": "dummyValue",
        "Version": 1,
        "LastModifiedDate": "2024-06-21T13:53:23.347000-04:00",
        "ARN": "arn:aws:ssm:us-east-1:PRODUCER_ACCOUNT_ID:parameter/dummyName",
        "DataType": "text"
    }
}

It works!

Now, deploy the consumer stack using consumer account:

$ npx cdk deploy dummy-stack

You should see the value returned:

Outputs:
dummy-stack.paramvalue = dummyValue

@aws-cdk-automation
Copy link
Collaborator

Comments on closed issues and PRs are hard for our team to see. If you need help, please open a new issue that references this one.

@aws aws locked as resolved and limited conversation to collaborators Jul 25, 2024
@pahud
Copy link
Contributor Author

pahud commented Sep 13, 2024

Update: cross-account SSM Parameters sharing is supported now. Check the doc for more details about the fromStringParameterArn() method.

If you need to know about SSM in AWS CDK, feel free to reference this blog post - SSM Parameters in AWS CDK from community.aws.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
@aws-cdk/aws-ssm Related to AWS Systems Manager effort/medium Medium work item – several days of effort feature-request A feature should be added or improved. p2
Projects
None yet
Development

No branches or pull requests

2 participants