aws / aws/aws-cdk

Support SSM Advanced (shared via RAM) parameters as CodeBuild environment variables

Open
#36,931 1 comment 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-ssm effort/medium feature-request p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the feature

# Feature Request

### Summary

AWS Systems Manager Parameter Store supports cross-account sharing of Advanced parameters via AWS RAM, however AWS CodeBuild does not currently allow using these shared Advanced parameters as environment variables via BuildEnvironmentVariableType.PARAMETER_STORE.

This creates an inconsistency between SSM capabilities and CodeBuild integration, and prevents a common and secure cross-account pattern from being used in CI/CD pipelines.

### Use Case

### Current Behavior

SSM Parameter Store Advanced parameters can be shared cross-account using AWS RAM
The shared parameter is visible in the consumer account (e.g. via describe-parameters)
ssm:GetParameter works when explicitly called using CLI/SDK and full ARN (subject to IAM/KMS)
CodeBuild fails to resolve shared parameters when configured as environment variables using BuildEnvironmentVariableType

### This happens when:

the parameter is Advanced
the parameter is shared via RAM
IAM permissions are correct
KMS permissions are correct
region matches
AWS documentation currently lists CodeBuild environment variables as an unsupported integration for shared parameters.

### Proposed Solution

CodeBuild should be able to resolve SSM Advanced parameters shared via AWS RAM when used as environment variables, similarly to how it resolves local-account SSM parameters.

Allow BuildEnvironmentVariableType.PARAMETER_STORE to reference:
shared Advanced parameters
using full parameter ARN
Behavior should be consistent with ssm:GetParameter access model

This should work for:
String
SecureString (with proper KMS permissions)

### Other Information

Related: https://github.com/aws/aws-cdk/issues/30603

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### AWS CDK Library version (aws-cdk-lib)

2.238.0

### AWS CDK CLI version

2.1105.0 (build 3e25a4e)

### Environment details (OS name and version, etc.)

Doesn't matter

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the AWS CDK CodeBuild integration for BuildEnvironmentVariableType.PARAMETER_STORE and the related issue #30603. Confirm how shared Advanced parameters are represented and identify the relevant validation or synthesis coverage; done means full-ARN String and SecureString parameters shared through AWS RAM can be configured as CodeBuild environment variables.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, devops
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.