Examkin

Question

Difficulty: MediumAWS Serverless Application Model (SAM)

A developer is using AWS Serverless Application Model (SAM) to deploy a database-backed API. The database password is saved as a SecureString in AWS Systems Manager Parameter Store. The developer attempts to reference this password in the SAM template's `Parameters` section as follows:

yaml
Parameters:
DbPassword:
Type: AWS::SSM::Parameter::Value<String>
Default: /prod/db/password

During the `sam deploy` process, AWS CloudFormation returns a validation error indicating that `AWS::SSM::Parameter::Value<String>` cannot reference SSM SecureString parameters.

How should the developer resolve this deployment failure while keeping the database password secure?

  1. Remove the parameter from the template's `Parameters` section and reference it directly in the function's environment variables using the `{{resolve:ssm-secure:/prod/db/password}}` dynamic reference.Answer
  2. B
    Update the parameter's `Type` to `AWS::SSM::Parameter::Value<SecureString>` in the `Parameters` section to support secure SSM parameters.
  3. C
    Add a new `Transform` statement specifically within the `Parameters` section of the template to compile the secure parameter values.
  4. D
    Modify the execution role's trust policy in the template to allow the `ssm.amazonaws.com` service principal to assume the role.

Answer

Remove the parameter from the template's `Parameters` section and reference it directly in the function's environment variables using the `{{resolve:ssm-secure:/prod/db/password}}` dynamic reference.
AWS CloudFormation parameters cannot resolve SSM SecureString parameters when using the `AWS::SSM::Parameter::Value<String>` type. To secure and dynamically retrieve sensitive configuration data from Parameter Store, developers must use dynamic references. By removing the parameter from the template's `Parameters` section and referencing `{{resolve:ssm-secure:/prod/db/password}}` directly within the resource properties (e.g., inside the environment variables of the function), the secure value is retrieved securely at deployment time without validation errors.

Step-by-Step Solution

1
Identify the cause of the CloudFormation deployment validation error.
CloudFormation parameters of type `AWS::SSM::Parameter::Value<String>` do not support SSM SecureString parameters to prevent accidental exposure of secrets.
This is a native limitation of AWS CloudFormation's Parameter Store integration.
2
Replace the static parameter declaration with a dynamic reference in the template.
Remove the parameter definition from the `Parameters` section and instead reference the SecureString using the dynamic reference format: `{{resolve:ssm-secure:/prod/db/password}}`.
Dynamic references tell CloudFormation to resolve the value from SSM at deployment/runtime without exposing the value in the template definition.
3
Ensure the Lambda execution role has permissions to read the parameter.
The Lambda function's IAM role permissions (not the trust policy) must allow `ssm:GetParameters` or `ssm:GetParameter` for the resource path.
This enables the Lambda execution context to successfully resolve the value.

Key Concept

AWS SAM Integration with Systems Manager Parameter Store Secure Strings
Rate this question

Topics

AWS Serverless Application Model (SAM)

More questions from this topic