Describe the feature

Now that parameter sharing between accounts is a feature, the CDK constructs should support ARN parameter names so that a shared parameter from a different account can be retrieved.

Use Case

I'm attempting to create the required Route53 resources in a multi-account organization. The DNS architecture we're using is:

• domain-account : contains the registered domain and a hosted zone.
• workload-account : contains workloads and has a sub-domain of the main domain in domain-account

In order for the CDK to create the required resources, I'm trying to use the following stacks:

WorkloadAccountStack - this stack creates a hosted zone, e.g. dev.domain.com, and creates a StringListParameter with a value of the NS entry of the new hosted zone. The parameter name is _dns_DevNameServers and is in the ADVANCED tier. Additionally, a CfnResourceShare is created to share the parameter with the domain-account.

DomainAccountStack - this stack creates a NS record in the domain.com hosted zone. To do this, the stack must get the value of the _dns_DevNameServers parameter from the workload-account.

AWS docs state that accessing a parameter is done by passing the ARN as the parameter name.

In 2.130 of CDK, I'm using the following code:

    public static string[] ValueForTypedListParameter(Construct scope, string id, string parameterName, Environment environment)
    {
        var parameterArn = Arn.Format(new ArnComponents
        {
            ArnFormat = ArnFormat.COLON_RESOURCE_NAME,
            Partition = AwsArnPartitions.Aws,
            Account = environment.Account,
            Region = environment.Region,
            Service = AwsArnServices.Ssm,
            Resource = AwsArnResources.Parameter,
            ResourceName = parameterName
        });

        var parameter = StringListParameter.FromListParameterAttributes(scope, id, new ListParameterAttributes
        {
            ParameterName = parameterArn
        });

        return parameter.StringListValue;
    }

When attempting to deploy the stack, I get the following error:

Could not determine the resource name from arn: arn:aws:ssm:ap-southeast-2:xxxxxxxxxxxxxx:parameter:_dns_DevNameServers

I believe this is due to using COLON_RESOURCE_NAME as the ArnFormat. I would like to use SLASH_RESOURCE_NAME, however, when using that, the synth process throws an error:

Error: Parameter names must be fully qualified (if they include "/" they must also begin with a "/")

Proposed Solution

At this stage I'm not sure where to start with a solution for this problem.

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.130

Environment details (OS name and version, etc.)

Windows 11