feat(ssm): support cross-account sharing

[pahud]

AWS introduced SSM Parameter Store cross-account sharing in Feb 2024. Under the hood, the sharing account has to create an AWS RAM ResourceShare for the principal of the consuming account and the consuming account has to accept the sharing invite. The only approach to access that sharing parameter is through CfnParameter. Dynamic Reference is NOT supported.

This PR adds StringParameter.fromStringParameterArn() method so we can use the API like

const remoteParameterArn = 'arn:aws:ssm:us-east-1:123456789012:parameter/dummyName';

const sharedParam = StringParameter.fromStringParameterArn(scope, id, remoteParameterArn);

new cdk.CfnOutput(this, 'ParamValue', { value: sharedParam.stringValue });

Note:

1. The only option to consume sharing parameters in CFN is template parameter. StringParameter.fromStringParameterArn() would synthesize CfnParameter like:

SharedParameter:
    Description: a shared golden AMI from centralised accounts
    Type: "AWS::SSM::Parameter::Value<String>"
    Default: "arn:aws:ssm:us-east-1:123456789012:parameter/sharedParameterName"

And the Default value has to be a static string. It can't be an unresolved token.

2. For full use case(sharing, accepting and consuming), check out integ.parameter-store-string-sharing.ts for more details.

Issue # (if applicable)

Closes #29292

Reason for this change

Description of changes

Description of how you validated changes

Debugger

{
  "version": "0.2.0",
  "configurations": [
    {
      "type": "node",
      "request": "launch",
      "name": "Jest",
      "program": "${workspaceFolder}/node_modules/jest/bin/jest.js",
      "cwd": "${workspaceFolder}/packages/aws-cdk-lib",
      "args": [
        "--verbose",
        "-i",
        "--no-cache",
        "test/parameter.test.ts",
      ],
      "console": "integratedTerminal",
      "internalConsoleOptions": "neverOpen",
      "skipFiles": [
        "<node_internals>/**"
      ],
      "outFiles": [
        "${workspaceFolder}/**/*.(m|c|)js",
        "!**/node_modules/**"
      ],
    }
  ]
}

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[shikha372]

Thanks @pahud for submitting the PR, left minor comment, also curious whether we are looking for any further implementation in future probably with help of custom resources etc. to achieve resource sharing feature.

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 5c3359c
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.