Support SSM Advanced (shared via RAM) parameters as CodeBuild environment variables
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the feature
# Feature Request
### Summary
AWS Systems Manager Parameter Store supports cross-account sharing of Advanced parameters via AWS RAM, however AWS CodeBuild does not currently allow using these shared Advanced parameters as environment variables via BuildEnvironmentVariableType.PARAMETER_STORE.
This creates an inconsistency between SSM capabilities and CodeBuild integration, and prevents a common and secure cross-account pattern from being used in CI/CD pipelines.
### Use Case
### Current Behavior
SSM Parameter Store Advanced parameters can be shared cross-account using AWS RAM
The shared parameter is visible in the consumer account (e.g. via describe-parameters)
ssm:GetParameter works when explicitly called using CLI/SDK and full ARN (subject to IAM/KMS)
CodeBuild fails to resolve shared parameters when configured as environment variables using BuildEnvironmentVariableType
### This happens when:
the parameter is Advanced
the parameter is shared via RAM
IAM permissions are correct
KMS permissions are correct
region matches
AWS documentation currently lists CodeBuild environment variables as an unsupported integration for shared parameters.
### Proposed Solution
CodeBuild should be able to resolve SSM Advanced parameters shared via AWS RAM when used as environment variables, similarly to how it resolves local-account SSM parameters.
Allow BuildEnvironmentVariableType.PARAMETER_STORE to reference:
shared Advanced parameters
using full parameter ARN
Behavior should be consistent with ssm:GetParameter access model
This should work for:
String
SecureString (with proper KMS permissions)
### Other Information
Related: https://github.com/aws/aws-cdk/issues/30603
### Acknowledgements
- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change
### AWS CDK Library version (aws-cdk-lib)
2.238.0
### AWS CDK CLI version
2.1105.0 (build 3e25a4e)
### Environment details (OS name and version, etc.)
Doesn't matter
Contributor guide
Research direction
Start by reviewing the AWS CDK CodeBuild integration for BuildEnvironmentVariableType.PARAMETER_STORE and the related issue #30603. Confirm how shared Advanced parameters are represented and identify the relevant validation or synthesis coverage; done means full-ARN String and SecureString parameters shared through AWS RAM can be configured as CodeBuild environment variables.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, devops
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100