AWS RAM でクロスアカウント共有されたパラメーターストアを AWS CDK で簡単に参照可能になりました

import { aws_ssm as ssm, Stack, StackProps, CfnOutput } from 'aws-cdk-lib';
import { Construct } from 'constructs';

export class CdkSampleStack extends Stack {
  constructor(scope: Construct, id: string, props: StackProps) {
    super(scope, id, props);

    const sharingAWSAccountId = process.env.SHARING_AWS_ACCOUNT_ID;

    const sharingParameterArn = `arn:aws:ssm:ap-northeast-1:${sharingAWSAccountId}:parameter/My/Parameter`;

    const sharedParam = ssm.StringParameter.fromStringParameterArn(
      this,
      'SharedParam',
      sharingParameterArn
    );

    new CfnOutput(this, 'SharedParamOutput', {
      value: sharedParam.stringValue,
    });
  }
}

$ npx cdk diff
Stack CdkSampleStack
Hold on while we create a read-only change set to get a diff with accurate replacement information (use --no-change-set to use a less accurate but faster template-only diff)
Could not create a change set, will base the diff on template differences (run again with -v to see the reason)
Parameters
[+] Parameter SharedParam.Parameter SharedParamParameter: {"Type":"AWS::SSM::Parameter::Value<String>","Default":"arn:aws:ssm:ap-northeast-1:undefined:parameter/My/Parameter"}

Outputs
[+] Output SharedParamOutput SharedParamOutput: {"Value":{"Ref":"SharedParamParameter"}}

✨  Number of stacks with differences: 1

$ npm run deploy

> [email protected] deploy
> cdk deploy --require-approval never --method=direct

（中略）

Outputs:
CdkSampleStack.SharedParamOutput = shared value

npm run deploy

> [email protected] deploy
> cdk deploy --require-approval never --method=direct

✨  Synthesis time: 3.63s

CdkSampleStack: deploying... [1/1]
CdkSampleStack: updating stack...

 ❌  CdkSampleStack failed: Error [ValidationError]: User: arn:aws:sts::XXXXXXXXXXXX:assumed-role/cdk-hnb659fds-cfn-exec-role-XXXXXXXXXXXX-ap-northeast-1/AWSCloudFormation is not authorized to perform: ssm:GetParameters on resource: arn:aws:ssm:ap-northeast-1:XXXXXXXXXXXX:parameter/My/Parameter because no resource-based policy allows the ssm:GetParameters action (Service: AWSSimpleSystemsManagement; Status Code: 400; Error Code: AccessDeniedException; Request ID: e4ea08cd-ca3d-4158-b8c4-bf1ce1513058; Proxy: null)
    at Request.extractError (/Users/wakatsuki.ryuta/projects/cm-rwakatsuki/cdk_sample_app/node_modules/aws-cdk/lib/index.js:396:46717)
    at Request.callListeners (/Users/wakatsuki.ryuta/projects/cm-rwakatsuki/cdk_sample_app/node_modules/aws-cdk/lib/index.js:396:91771)
    at Request.emit (/Users/wakatsuki.ryuta/projects/cm-rwakatsuki/cdk_sample_app/node_modules/aws-cdk/lib/index.js:396:91219)
    at Request.emit (/Users/wakatsuki.ryuta/projects/cm-rwakatsuki/cdk_sample_app/node_modules/aws-cdk/lib/index.js:396:199820)
    at Request.transition (/Users/wakatsuki.ryuta/projects/cm-rwakatsuki/cdk_sample_app/node_modules/aws-cdk/lib/index.js:396:193373)
    at AcceptorStateMachine.runTo (/Users/wakatsuki.ryuta/projects/cm-rwakatsuki/cdk_sample_app/node_modules/aws-cdk/lib/index.js:396:158245)
    at /Users/wakatsuki.ryuta/projects/cm-rwakatsuki/cdk_sample_app/node_modules/aws-cdk/lib/index.js:396:158575
    at Request.<anonymous> (/Users/wakatsuki.ryuta/projects/cm-rwakatsuki/cdk_sample_app/node_modules/aws-cdk/lib/index.js:396:193665)
    at Request.<anonymous> (/Users/wakatsuki.ryuta/projects/cm-rwakatsuki/cdk_sample_app/node_modules/aws-cdk/lib/index.js:396:199895)
    at Request.callListeners (/Users/wakatsuki.ryuta/projects/cm-rwakatsuki/cdk_sample_app/node_modules/aws-cdk/lib/index.js:396:91939) {
  code: 'ValidationError',
  time: 2024-08-28T13:16:24.878Z,
  requestId: 'b22a00fe-e667-49c2-a416-fa1acb7c44cc',
  statusCode: 400,
  retryable: false,
  retryDelay: 382.3103595921336
}