ssm.StringParameter.valueFromLookup for shared parameters

[frjonsen]

We have a parameter that is stored in one account, which contains a comma-separated list needed when running synth in a CDK app in a separate account. I have figured out that had the parameter been present in the same account as the CDK app, I could've used StringParameter.valueFromLookup to make this data available at synth time. I've also noticed that there is another function, StringParameter.fromStringParameterArn, which can be used to retrieve a shared parameter at deploy time. How can I do the combination of these two? I have so far been unable to find a way to resolve a shared parameter at synth time. I really do need this data at synth time, or else I could've resorted to using StringParameter.fromStringParameterArn in combination with a custom resource, but unfortunately that doesn't help me here.

I also looked into calling SSM directly using the AWS SDK for Typescript, but unfortunately that also ended up being a dead end, as the SDK is entirely async, and the CDK doesn't appear to work well with promises.

I feel like the only option I have left is to wrap the CDK in a bash script which first calls the SSM API using the AWS CLI, but that really feels like an ugly workaround for what really feels like something the CDK should support. There is clearly already an intention to support resolving values at synth time, and also an intention to support shared parameter. Is there really no way to do the combination of these two?

[boenhoff]

Hey @frjonsen - did you found a working solution for that?

[frjonsen]

We did end up managing to figure out how to use the SDK to resolve the parameters at synth time. We no longer use it because our needs changed, but it worked fine for as long as we were using it.

[tamish-max]

As far as I know, CDK doesn’t have a built-in “cross-account synth-time SSM lookup” equivalent to StringParameter.valueFromLookup().

That API is intentionally a synth-time context lookup for the current environment/account.

So the practical options are:

1. pre-synth fetch the parameter and pass it into CDK as context/env
2. switch to deploy-time resolution (fromStringParameterArn / custom resource) if synth-time is not strictly required

If you truly need synth-time, the least-magic version is to fetch it before app construction:

import { execSync } from "node:child_process";

const raw = execSync(
  "aws ssm get-parameter --profile shared-account --name /my/list --query Parameter.Value --output text",
  { encoding: "utf8" }
).trim();

const sharedList = raw.split(",");

Then use sharedList in your constructs.

It is a bit ugly, but I think that’s the honest limitation today: synth-time cross-account lookups need to happen outside CDK’s normal context provider system. If you go this route, I’d also cache/validate the value so synths stay reproducible.