aws / aws/aws-cdk

(cdk-core): (Cfn Parameter value is not updated when source SSM Parameter is renamed)

Open
#20,377 13 comments 3 reactions 0 assignees View on GitHub
@aws-cdk/aws-ssm @aws-cdk/core bug documentation effort/medium p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

When CDK creates CloudFormation Stack Parameter from SSM Parameter, and the SSM Parameter name is changed, there is no or no easy way to get the change deployed.

### Expected Behavior

CloudFormation Stack Parameter value will be read from the renamed SSM Parameter.

### Current Behavior

CloudFormation Stack Parameter value stuck to the initially deployed SSM Parameter.

### Reproduction Steps

- [ ] Create SSM Parameter "X" with e.g. AWS CLI: `aws ssm put-parameter --name "X" --type String --value "something something"`
- [ ] Create SSM Parameter "Y" with e.g. AWS CLI: `aws ssm put-parameter --name "Y" --type String --value "something new"`
- [ ] Deploy the following CDK app to the same account/region you created the SSM Parameters in the previous steps

```ts
import { App, Stack, aws_ssm } from 'aws-cdk-lib';
import { Construct } from 'constructs';

export class MyStack extends Stack {
constructor(scope: Construct, id: string) {
super(scope, id);

/* create SSM parameter using aws cli:
* aws ssm put-parameter --name "X" --type String --value "something something"
*/

/* create another SSM parameter using aws cli:
* aws ssm put-parameter --name "Y" --type String --value "something new"
*/

/* delete the original SSM parameter:
* aws ssm delete-parameter --name "X"
*/

// toggle this parameter value between "X" and "Y" to see the difference
const parameterName = 'X';

// read already existing SSM parameter X
const x = aws_ssm.StringParameter.fromStringParameterAttributes(this, 'X', {
parameterName: parameterName,
}).stringValue;

// write parameter X value into new SSM parameter Y
new aws_ssm.StringParameter(this, 'Z', {
stringValue: x,
});
}
}

const app = new App();

new MyStack(app, 'UpdateParameters');
app.synth();

```

- [ ] Toggle variable `parameterName` value to `Y`
- [ ] Run `cdk diff`, it should show following:

```
Stack UpdateParameters
Parameters
[~] Parameter X.Parameter XParameter: {"Type":"AWS::SSM::Parameter::Value","Default":"X"} to {"Type":"AWS::SSM::Parameter::Value","Default":"Y"}
```

- [ ] Deploy the updated stack – it shows "no changes" (which is unexpected)

```
UpdateParameters: deploying...
...
UpdateParameters: creating CloudFormation changeset...

✅ UpdateParameters (no changes)
```

- [ ] Delete the SSM Parameter "X" with e.g. AWS CLI: aws ssm delete-parameter --name "X"

- [ ] Deploy the updated stack – it fails!

```
UpdateParameters: deploying...
...
UpdateParameters: creating CloudFormation changeset...

❌ UpdateParameters failed: Error [ValidationError]: Unable to fetch parameters [X] from parameter store for this account.

Unable to fetch parameters [X] from parameter store for this account.
```

### Possible Solution

Allow user to set "UsePreviousValue": `false` for Parameters when creating CloudFormation ChangeSet – that's how you solve this type of problem in CloudFormation.

### Additional Information/Context

CDK verbose output when trying to create ChangeSet:

```
UpdateParameters: creating CloudFormation changeset...
Call failed: createChangeSet({
"StackName": "UpdateParameters",
"ChangeSetName": "cdk-deploy-change-set",
"ChangeSetType": "UPDATE",
"Description": "CDK Changeset for execution xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"TemplateURL": "https://s3.eu-west-1.amazonaws.com/cdk-hnb659fds-assets-111111111111-eu-west-1/cefdc5a2b337755dcd2047e2dac56831b5a4155ebdebe6939e040f4d5315e1bc.json",
"Parameters": [
{ "ParameterKey": "XParameter", "UsePreviousValue": true },
{ "ParameterKey": "BootstrapVersion", "UsePreviousValue": true }
],
"RoleARN": "arn:aws:iam::111111111111:role/cdk-hnb659fds-cfn-exec-role-111111111111-eu-west-1",
"Capabilities": [
"CAPABILITY_IAM",
"CAPABILITY_NAMED_IAM",
"CAPABILITY_AUTO_EXPAND"
],
"Tags": []
}) => Unable to fetch parameters [X] from parameter store for this account. (code=ValidationError)
```

`UpdateParameters.template.json` after toggling `parameterName` to `Y` (Conditions redacted):

```
{
"Parameters": {
"XParameter": {
"Type": "AWS::SSM::Parameter::Value",
"Default": "Y"
},
"BootstrapVersion": {
"Type": "AWS::SSM::Parameter::Value",
"Default": "/cdk-bootstrap/hnb659fds/version",
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
}
},
"Resources": {
"Z1BAC85DC": {
"Type": "AWS::SSM::Parameter",
"Properties": {
"Type": "String",
"Value": {
"Ref": "XParameter"
}
},
"Metadata": {
"aws:cdk:path": "UpdateParameters/Z/Resource"
}
},
"CDKMetadata": {
"Type": "AWS::CDK::Metadata",
"Properties": {
"Analytics": "v2:deflate64:H4sIAAAAAAAA/03LUQ6CMBAE0LPw3y6WqBfgAgQPYGq7mgW6TXaLfhjuLoRE/ZqZ5E0DzRFc5V9qQxztRDd4X4oPo2nv3HnxCQuK6VHzLAHNCq+qaUNC/PiJf75s63tZe5s5UqHMi+EcEQatn+4M7gSHalAiKzMXSgj9nh/U0bnLlgAAAA=="
},
"Metadata": {
"aws:cdk:path": "UpdateParameters/CDKMetadata/Default"
},
"Condition": "CDKMetadataAvailable"
}
},
"Conditions": {},
"Rules": {
"CheckBootstrapVersion": {
"Assertions": [
{
"Assert": {
"Fn::Not": [
{
"Fn::Contains": [
[
"1",
"2",
"3",
"4",
"5"
],
{
"Ref": "BootstrapVersion"
}
]
}
]
},
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
}
]
}
}
}
```

### CDK CLI Version

2.24.1 (build 585f9ca)

### Framework Version

_No response_

### Node.js Version

v16.15.0

### OS

macOS Monterey Version 12.4

### Language

Typescript

### Language Version

4.6.4

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with cdk deploy's CloudFormation change-set request, using the verbose createChangeSet output and generated UpdateParameters.template.json shown in the report. Trace why XParameter is sent with UsePreviousValue true after the default changes; done when deploying the renamed SSM parameter uses the new value instead of reporting no changes or failing because X is missing.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cli, cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.