How to read parameter store from a different region in CDK?

Question

I am using CDK to deploy AWS resources but need to get some values from the parameter store from a different region. I can see this API in CDK's reference page to read a parameter:

ssm.StringParameter.fromStringParameterAttributes

But it doesn't support passing region. How can I make it work across region?

Answer 1

You can find an implementation here:

import { Construct } from 'constructs';
import { AwsCustomResource, AwsCustomResourcePolicy, AwsSdkCall, PhysicalResourceId } from 'aws-cdk-lib/custom-resources';

interface SSMParameterReaderProps {
  readonly parameterName: string;
  readonly region: string;
}

export class SSMParameterReader extends AwsCustomResource {
  constructor(scope: Construct, name: string, props: SSMParameterReaderProps) {
    const { parameterName, region } = props;

    super(scope, name, {
      onUpdate: {
        action: 'getParameter',
        service: 'SSM',
        parameters: {
          Name: parameterName,
        },
        region,
        physicalResourceId: PhysicalResourceId.of(name),
      },
      policy: AwsCustomResourcePolicy.fromSdkCalls({
        resources: AwsCustomResourcePolicy.ANY_RESOURCE,
      }),
    });
  }

  public getParameterValue(): string {
    return this.getResponseFieldReference('Parameter.Value').toString();
  }
}

Source: https://github.com/Idea-Pool/aws-static-site/blob/main/lib/ssm-parameter-reader.ts

(Based on CloudFormation Cross-Region Reference)

Answer 2

This article explains what you are looking for

How to read parameter store from a different region in CDK?

Summary: Create an AWS custom resource that takes in the parameterName and the regionName as props and returns the value.

Answer 3

Here is the python's version, the code will work assuming the certificate and the parameter store which has the certificate arn are already created in us-east-1

from aws_cdk import (
    aws_certificatemanager as acm
)
import aws_cdk.custom_resources as cr

retrieving_arn = cr.AwsCustomResource(self, "RetrievingARN",
            on_update=cr.AwsSdkCall( # will also be called for a CREATE event
                service="SSM",
                action="getParameter",
                parameters={
                    "Name": "acm-certificate-arn"
                },
                region="us-east-1",
                physical_resource_id=cr.PhysicalResourceId.of("retrieving-certificate-arn-cross-region")),
            policy=cr.AwsCustomResourcePolicy.from_sdk_calls(
                resources=cr.AwsCustomResourcePolicy.ANY_RESOURCE
            )
        )
        
    

the_certificate_arn = retrieving_arn.get_response_field("Parameter.Value")

actual_certificate = acm.Certificate.from_certificate_arn(
            self, "RetrievingCertificate", certificate_arn=the_certificate_arn 
        )

Answer 4

It is not currently possible to access SSM Parameters in a different region.

You would have to set up some process to replicate the parameter across the needed regions and keep them in sync.

You could also get the value using a custom resource backed by a lambda.