Use cases

Inject a database hostname, connection string, or feature flag from a shared SSM path into an EC2 launch configuration, ECS task definition, or Lambda environment variable.

Share a configuration value across stacks in the same account and region without export and import coupling.

Reference environment-specific configuration using a parameterised SSM path — the same template serves staging and production by varying the path prefix.

Updraft::SSM::Parameter makes an SSM Parameter Store value available as a resource attribute in your template. The parameter is resolved inside the CloudFormation execution model — ordered by the same dependency graph as every other resource in the stack. If the resolution fails, CloudFormation rolls back the operation.

Template usage

Declare the resource, then reference its Value attribute anywhere in the template that accepts a string:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
Resources:
  DbHost:
    Type: Updraft::SSM::Parameter
    Properties:
      Name: /myapp/production/db/host

  AppServer:
    Type: AWS::EC2::Instance
    DependsOn: DbHost
    Properties:
      UserData:
        Fn::Base64:
          !Sub "DB_HOST=${DbHost.Value}"

The Name property accepts any valid SSM parameter path. The Value attribute returns the parameter’s string value after resolution.

SecureString parameters

For SecureString parameters, the value is decrypted at resolution time using the execution role’s KMS permissions. The decrypted value passes through CloudFormation’s internal handling — it is not written to stack events or outputs unless you explicitly reference it there.

Add kms:Decrypt on the KMS key alongside ssm:GetParameter in the CloudFormation execution role:

1
2
3
4
5
6
7
8
{
  "Effect": "Allow",
  "Action": ["ssm:GetParameter", "kms:Decrypt"],
  "Resource": [
    "arn:aws:ssm:REGION:ACCOUNT_ID:parameter/PATH",
    "arn:aws:kms:REGION:ACCOUNT_ID:key/KEY_ID"
  ]
}

Prerequisites and compatibility

Prerequisites

CloudFormation execution role requires ssm:GetParameter on the target parameter ARN or path prefix.
For SecureString parameters, the execution role also requires kms:Decrypt on the KMS key used to encrypt the parameter.
The parameter must exist in the same account and region before stack creation begins.

Compatibility

CloudFormation: All CloudFormation-supported AWS regions.
AWS services: AWS Systems Manager Parameter Store (Standard and Advanced tiers)
AWS Key Management Service (SecureString parameters only)

Lifecycle expectations

The parameter value is resolved when CloudFormation processes the resource — at create time and at each subsequent update that touches the resource. Deleting the extension resource from a stack does not delete the SSM parameter: the extension reads a value that exists independently of the stack, and the stack does not take ownership of it.

SSM Parameter