Skip to content

(aws-iam): StringParameter.value_from_lookup's dummy value did not suffice #8699

@ThomasSteinbach

Description

@ThomasSteinbach
aws_iam.StringParameter.value_from_lookup(...)

returns a dummy-value-for-${parameterName} during synthesis (from #3654). This value did not suffice for use as ARN. The dummy value itself should represent a dummy ARN pattern to avoid errors.

Reproduction Steps

Here is a short (and stripped) example, which currently leads to an error:

aws_kms.Key.from_key_arn(
    self,
    id,
    key_arn=aws_ssm.StringParameter.value_from_lookup(
        self,
        parameter_name="/example/param",
    ),
)

Error Log

During synthesis this leads to an error:

jsii.errors.JSIIError: ARNs must have at least 6 components: dummy-value-for-/example/param

Workaround

_param = aws_ssm.StringParameter.value_from_lookup(self, parameter_name="/example/param")

if "dummy-value" in _param:
    _param = "arn:aws:service:eu-central-1:123456789012:entity/dummy-value"

aws_kms.Key.from_key_arn(
    self,
    id,
    key_arn=_param,
)

Solution Proposal

Instead of dummy-value-for-${parameterName} the method should return something like arn:aws:service:eu-central-1:123456789012:entity/dummy-value

This solution would also address/solve #7051


This is 🐛 Bug Report

Metadata

Metadata

Assignees

No one assigned

    Labels

    @aws-cdk/aws-iamRelated to AWS Identity and Access ManagementbugThis issue is a bug.effort/smallSmall work item – less than a day of effortgood first issueRelated to contributions. See CONTRIBUTING.mdp1

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions