SSMAgent: Invalid parameters when using parameter store pass-through to SecretsManager {{ssm:/aws/reference/secretsmanager/Secret}}

I am seeing an error with amazon-ssm-agent when attempting to use AWS-RunPowerShellScript with variable in the format {{ssm:*}} to retrieve from parameter store(secrets manager pass-through)

My agent version is 3.3.1142.0
My OS is Windows Server 2022 (build 20348.2762)

It works fine when using {{ssm:parametername}} but when using {{ssm:/aws/reference/secretsmanager/secretname}} it fails to validate with the error `2024-11-12 15:05:19.1463 ERROR [ssm-agent-worker] [MessageService] [MGSInteractor] dropping message because cannot parse AgentJob message 0b567543-j549-5b77-t83i-37986frf3a13 to Document State, err: Input contains invalid parameters [/aws/reference/secretsmanager/Secret]
`

My code is below:
``Send-SSMCommand -InstanceId $instance_id -DocumentName 'AWS-RunPowerShellScript' -Parameter @{commands = "`$secret_viaProxy = '{{ssm:/aws/reference/secretsmanager/Secret}}'" }``

The formatting of the code above is not working quite right because of the backticks required by the actual command I had to add a few backticks to get it to format to code properly, but you can run the below sample to get the same results. This works if its in the format {{ssm:parameterWithNoSlashesToReferenceSecret}}
@{commands = "echo '{{ssm:/aws/reference/secretsmanager/Secret}}'"}

{{ssm:parametername}} works great as detailed [here](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-param-runcommand.html)

Systems Manager also supports accessing secrets using Parameter store as a 'pass-through' to secrets manager formatted as /aws/reference/secretsmanager/Secret, and as detailed [here](https://docs.aws.amazon.com/systems-manager/latest/userguide/integration-ps-secretsmanager.html)

I believe some of the relevant sections are below:
https://github.com/aws/amazon-ssm-agent/blob/16960130aed5d5ec5765a5ec510cab298aabf7a9/agent/ssm/ssmparameterresolver/resolverbridge.go#L27

Here is where the 'Input contains invalid parameters' is coming from:
https://github.com/aws/amazon-ssm-agent/blob/16960130aed5d5ec5765a5ec510cab298aabf7a9/agent/framework/docparser/parameterstore/parameterstore.go#L227

Its from the function 'getSSMParameterValues' and the regex is below:
https://github.com/aws/amazon-ssm-agent/blob/16960130aed5d5ec5765a5ec510cab298aabf7a9/agent/framework/docparser/parameterstore/parameterstore.go#L203

This is supported by aws cli and aws tools for powershell


Start with agent/framework/docparser/parameterstore/parameterstore.go, especially getSSMParameterValues and the regex near line 203, then inspect agent/ssm/ssmparameterresolver/resolverbridge.go. Reproduce the failure with AWS-RunPowerShellScript using {{ssm:/aws/reference/secretsmanager/Secret}} and compare it with a slash-free parameter name. Done means the pass-through form is accepted and resolves without the invalid-parameters error.

Written by the indexing model from the issue text.