Examkin

Soru

Zorluk: OrtaAWS Serverless Application Model (SAM)

A developer is using AWS Serverless Application Model (SAM) to deploy a database-backed API. The database password is saved as a SecureString in AWS Systems Manager Parameter Store. The developer attempts to reference this password in the SAM template's `Parameters` section as follows:

yaml
Parameters:
DbPassword:
Type: AWS::SSM::Parameter::Value<String>
Default: /prod/db/password

During the `sam deploy` process, AWS CloudFormation returns a validation error indicating that `AWS::SSM::Parameter::Value<String>` cannot reference SSM SecureString parameters.

How should the developer resolve this deployment failure while keeping the database password secure?

  1. Remove the parameter from the template's `Parameters` section and reference it directly in the function's environment variables using the `{{resolve:ssm-secure:/prod/db/password}}` dynamic reference.Cevap
  2. B
    Update the parameter's `Type` to `AWS::SSM::Parameter::Value<SecureString>` in the `Parameters` section to support secure SSM parameters.
  3. C
    Add a new `Transform` statement specifically within the `Parameters` section of the template to compile the secure parameter values.
  4. D
    Modify the execution role's trust policy in the template to allow the `ssm.amazonaws.com` service principal to assume the role.

Cevap

Remove the parameter from the template's `Parameters` section and reference it directly in the function's environment variables using the `{{resolve:ssm-secure:/prod/db/password}}` dynamic reference.
AWS CloudFormation parameters cannot resolve SSM SecureString parameters when using the `AWS::SSM::Parameter::Value<String>` type. To secure and dynamically retrieve sensitive configuration data from Parameter Store, developers must use dynamic references. By removing the parameter from the template's `Parameters` section and referencing `{{resolve:ssm-secure:/prod/db/password}}` directly within the resource properties (e.g., inside the environment variables of the function), the secure value is retrieved securely at deployment time without validation errors.

Adım Adım Çözüm

1
Identify the cause of the CloudFormation deployment validation error.
CloudFormation parameters of type `AWS::SSM::Parameter::Value<String>` do not support SSM SecureString parameters to prevent accidental exposure of secrets.
This is a native limitation of AWS CloudFormation's Parameter Store integration.
2
Replace the static parameter declaration with a dynamic reference in the template.
Remove the parameter definition from the `Parameters` section and instead reference the SecureString using the dynamic reference format: `{{resolve:ssm-secure:/prod/db/password}}`.
Dynamic references tell CloudFormation to resolve the value from SSM at deployment/runtime without exposing the value in the template definition.
3
Ensure the Lambda execution role has permissions to read the parameter.
The Lambda function's IAM role permissions (not the trust policy) must allow `ssm:GetParameters` or `ssm:GetParameter` for the resource path.
This enables the Lambda execution context to successfully resolve the value.

Anahtar Kavram

AWS SAM Integration with Systems Manager Parameter Store Secure Strings
Bu soruyu puanla

Konular

AWS Serverless Application Model (SAM)

Bu konudan daha fazla soru