SSM: StringParameter.valueFromLookup should return undefined if SSM parameter not available

[astef]

Describe the feature

When using ssm.StringParameter.valueFromLookup, it crashes (not sure, but error is not catchable), when the parameter doesn't exist. It makes it unusable for scenarios with a fallback parameter.

Use Case

For a short-lived infrastructure it's both important to be configurable (create a parameter & deploy), and have a nice fallback value (just deploy). SSM parameter is a perfect solution, since it can be resolved at synth time. It's very unfortunate, that currently it's impossible not to crash, when the value doesn't exist.

Proposed Solution

Return undefined, instead of crashing, or expose a better API, with multiple fallback parameter names to check.

Other Information

This issue was also discussed here: #7259

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2

Environment details (OS name and version, etc.)

Any

[mascur]

Thank you for the ticket, I've labeled this as both a bug and feature-request since it seems to be a bit of both. One approach you could take would be to use a custom resource as mentioned here: #7259 (comment) to handle fallback values.

[sammcj]

We just got hit by this as well, it certainly seems like a bug.

[otaviomacedo]

@astef Just to clarify, when you say "it crashes", do you mean that the CLI prints an error message like this:

[Error at /MyStack] SSM parameter not available in account 12345689, region us-east-1: foo

Found errors

and returns exit code 1?

If that's the case, the template is still generated. To know whether the parameter exists at runtime, check whether the value starts with "dummy-value-for-".

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

[andrew-glenn]

@otaviomacedo Thanks - but that doesn't solve the exit code 1 problem when dealing with automation.

[tyrauber]

This exit code 1 is a problem for SST.

It prevents conditionally creating resources by testing whether an ssm value exists.

Take a look as the aws-cdk-lib ssm documentation #lookup-existing-parameters.

const arnLookup = ssm.StringParameter.valueFromLookup(this, '/my/topic/arn');
sns.Topic.fromTopicArn(this, 'Topic', arnLookup);

Initially arnLookup will be equal to dummy-value-for-/my/topic/arn which will cause Topic.fromTopicArn to throw an error indicating that the value is not in arn format.

This is no longer true. In actuality, .valueFromLookup throws the exit code 1 itself preventing further use. Take for example the following code built with SST.

import * as cdk from 'aws-cdk-lib';
import * as iam from "aws-cdk-lib/aws-iam";
import * as ssm from 'aws-cdk-lib/aws-ssm';

import { StackContext, attachPermissionsToRole  } from 'sst/constructs';

export function Role({ stack, app }: StackContext) {
  let role;
  let parameterName = `/${app.name}/Config/RoleArn`;
  let roleArn = ssm.StringParameter.valueFromLookup(stack, parameterName);

  stack.addOutputs({
    ROLEARN: role?.roleArn
  });

  return { role };
}

Just looking up the value with valueFromLookup throws an exit code 1 causing SST deployment to fail.

Error: Could not resolve context values for ssm:account=00000000000:parameterName=/sst-iam/Config/RoleArn:region=us-east-1
 > LIFECYCLE  Command failed with exit code 1.
 

[T-Guerrero]

This is no longer true. In actuality, .valueFromLookup throws the exit code 1 itself preventing further use. Take for example the following code built with SST.

Wrong, this remains true. In your case, I think the issue is that SSM is not being able to fetch your stack scope properly. From the method description:

     * Reads the value of an SSM parameter during synthesis through an
     * environmental context provider.
     *
     * Requires that the stack this scope is defined in will have explicit
     * account/region information. Otherwise, it will fail during synthesis.

[tyrauber]

Ah, thank you for the correction / clarification, @T-Guerrero.

[ivantichy]

Just faced this issue too, exit code 1.
Account and region set up correctly.
Got error message:
[Error at /Stack/MyStack] SSM parameter not available in account xxxxxxxxx, region eu-central-1: /myparam

Template is generated with dummy value however exit code 1 hurts e.g. automated pipeline.

[Jonathan-Joransen]

One issue can be if you aren't passing the stack props to the super constructor. This will cause the stack to not detect the env even though it is specified in the stack props.

Here is a C# example:
Correct
internal CDKStack(Construct scope, string id, StackProps props) : base(scope, id, props)
Incorrect
internal CDKStack(Construct scope, string id, StackProps props) : base(scope, id)

Just faced this issue too, exit code 1. Account and region set up correctly. Got error message: [Error at /Stack/MyStack] SSM parameter not available in account xxxxxxxxx, region eu-central-1: /myparam

Template is generated with dummy value however exit code 1 hurts e.g. automated pipeline.