aws / aws/aws-cdk

(Amplify): SSM Secure reference is not supported in: [AWS::Amplify::App/Properties/OauthToken]

Open
#11,858 4 comments 13 reactions 0 assignees View on GitHub
@aws-cdk/aws-amplify blocked bug effort/small needs-cfn p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

Setting up a `GitHubSourceCodeProvider` seems to fail at deployment time if using `SecretValue.ssmSecure`.

❌ Stack failed: Error [ValidationError]: SSM Secure reference is not supported in: [AWS::Amplify::App/Properties/OauthToken]

### Reproduction Steps

```ts

const amplifyApp = new amplify.App(this, 'app', {
sourceCodeProvider: new amplify.GitHubSourceCodeProvider({
repository,
owner: 'markusl',
oauthToken: cdk.SecretValue.ssmSecure('GITHUB_OAUTH_TOKEN'),
}),
});
```

### What did you expect to happen?

I would expect this to work.

### Environment

- **CDK CLI Version :** 1.75.0 (build 7708242)
- **Framework Version:** 1.75.0 (build 7708242)
- **Node.js Version:** v14.15.1
- **OS :** macOs
- **Language (Version):** TypeScript 4

### Other

---

This is :bug: Bug Report

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the deployment from the GitHubSourceCodeProvider example using amplify.App and SecretValue.ssmSecure. Then inspect how the oauthToken reaches AWS::Amplify::App/Properties/OauthToken. Done means the deployment accepts the SSM Secure reference, or the issue is documented as an AWS limitation with a supported alternative identified.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.