8

I am having problems using SSM valueForStringParameter method in CDK. It's working the first time I deploy the stack, but it is not picking up updates to the parameter value when I redeploy the stack because CloudFormation template hasn't changed and so CloudFormation thinks there were no updates, even if SSM parameter has changed.

For the context, I am deploying stack via CodePipeline, where I run cdk synth first, and then use CloudFormationCreateUpdateStackAction action to deploy template.

Anyone knows how to work around that? The only other option that I know will work is to switch to a custom resource lambda that calls SSM and returns value using aws-sdk, but that feels like a overly complicated option.

Update 1 I cannot use ValueFromLookupbecause value is only updated at runtime as part of cloudformation deployment by another stack (I deploy both stacks in CodePipeline, in 2 different regions), so synthesis time lookup would result in stale value.

Tofig Hasanov
  • 3,303
  • 10
  • 51
  • 81
  • I'm facing the same issue. I wanted to use the result of synth as an env agnostic package, but some Constructs are basically impossible to use without the lookup functions. For example, anything that requires an `IVpc` needs either a newly created vpc or the result of a `VPC.fromLookup` function. – Pedreiro Apr 26 '20 at 11:34

3 Answers3

5

All the valueOf* and from* methods work by adding a CloudFormation parameter. As you figured out already, changing the parameter value does not change the template and no change will be triggered.

What you probably want to use instead is the method valueFromLookup. Lookups are executed during synth and the result is put into the generated CFN template.

ssm.StringParameter.valueFromLookup(this, 'param-name');

But be aware, lookups are stored in the cdk.context.json. If you have commited that file to your repo, you need to erase that key via cdk context -e ... before synth/diff/deploy.

udondan
  • 57,263
  • 20
  • 190
  • 175
  • 1
    That would work, except in my case value is only set at runtime, so synthesis time check wouldn’t pick latest value. I’ve updated my question – Tofig Hasanov Apr 23 '20 at 08:05
  • Would it make sense to return the param value then as CFN output/export? This then could be consumed by the 2nd stack. – udondan Apr 23 '20 at 11:17
  • I wish I could. Unfortunately the second stack is in another region (because lambda@edge only supports us-east-1), and the first stack is in Europe. Second stack uses custom resource lambda to store value in Europe SSM, and that part works ok. I have now worked around the problem by using a custom resource lambda in the first stack instead of valueFromStringParameter and that works, but it looks like overengineering – Tofig Hasanov Apr 23 '20 at 11:25
3

Since you cannot use lookup functions and the most common way to pass config to cdk is through context variables, I can only suggest dirty workarounds.

For example, you could create a dummy parameter in your stack to bump every time there's deployment.

var deploymentId = new CfnParameter(this, "deploymentId", new CfnParameterProps() { Type = "String", Description = "Deployment Id" });
SetParameterValue(deploymentId, this.Node.GetContext("deploymentId").ToString());

and when you synthesize the CF, you could generate an ID:

cdk synth -c deploymentId=$(uuidgen)

If you can avoid the "environment agnostic" syth and you really need an immutable artifact to deploy across multiple environments, you could use the built package from your cdk, for example, the npm package containing your cdk. Therefore, you could deploy it in each environment by overwriting the context parameters instead of using ssm parameters store.

Pedreiro
  • 1,641
  • 2
  • 18
  • 28
1

See https://docs.aws.amazon.com/cdk/latest/guide/get_ssm_value.html, you can use method valueFromLookup which gets you parameter store value at synthesis time, when value is different from previous one, this shall trigger CF stack update.

However, I was under impression that valueForStringParameter should work on updated ssm parameter values as well, based on https://aws.amazon.com/blogs/mt/integrating-aws-cloudformation-with-aws-systems-manager-parameter-store/ Example 2:

Milan Gatyás
  • 2,509
  • 1
  • 17
  • 23
  • I’ve updated my question regarding why I cannot use synthesis time lookup. Example 2 indeed suggests that it should work, so I’ll try to dig a bit deeper – Tofig Hasanov Apr 23 '20 at 08:04