{"id":8865,"library":"aws-cdk-aws-ssm","title":"AWS CDK AWS Systems Manager (SSM) Construct Library (v1)","description":"The `aws-cdk-aws-ssm` package provides CDK constructs for provisioning AWS Systems Manager (SSM) resources such as Parameter Store parameters within your AWS Cloud Development Kit applications. This specific package is part of AWS CDK v1, which reached End-of-Support on June 1, 2023. The AWS CDK project is active with weekly updates for v2, which consolidates all stable constructs into a single `aws-cdk-lib` package. [2, 4, 15, 29]","status":"deprecated","version":"1.204.0","language":"en","source_language":"en","source_url":"https://github.com/aws/aws-cdk.git","tags":["aws","cdk","ssm","systems-manager","parameter-store","infrastructure-as-code","cloud","deprecated"],"install":[{"cmd":"pip install aws-cdk.aws-ssm","lang":"bash","label":"For AWS CDK v1 (Deprecated)"},{"cmd":"pip install aws-cdk-lib","lang":"bash","label":"For AWS CDK v2 (Recommended)"}],"dependencies":[{"reason":"Core CDK functionality for v1 packages.","package":"aws-cdk.core","optional":false},{"reason":"The consolidated construct library for AWS CDK v2, which is the recommended version.","package":"aws-cdk-lib","optional":false},{"reason":"The base constructs library, required by both CDK v1 and v2.","package":"constructs","optional":false}],"imports":[{"note":"CDK v1 used `aws_cdk.aws_ssm` as a separate module. CDK v2 consolidates services under `aws_cdk` in the `aws-cdk-lib` package. [3, 15, 29]","wrong":"import aws_ssm","symbol":"StringParameter","correct":"import aws_cdk.aws_ssm as ssm # For AWS CDK v1\n# OR (Recommended for AWS CDK v2)\nfrom aws_cdk import aws_ssm"}],"quickstart":{"code":"import os\nimport aws_cdk as cdk\nfrom constructs import Construct\nfrom aws_cdk import aws_ssm\n\nclass MySsmStack(cdk.Stack):\n    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:\n        super().__init__(scope, construct_id, **kwargs)\n\n        # Create a new String Parameter in SSM Parameter Store\n        aws_ssm.StringParameter(self, \"MyParameter\",\n            parameter_name=\"/my/app/config/value\",\n            string_value=\"MyParameterValue\",\n            description=\"A parameter for my application configuration\",\n            tier=aws_ssm.ParameterTier.STANDARD\n        )\n\n        # Look up an existing String Parameter at synthesis time\n        # Note: This will perform an AWS API call during 'cdk synth'\n        # and cache the value in cdk.context.json. [3, 22]\n        existing_param_value = aws_ssm.StringParameter.value_from_lookup(\n            self, \"ExistingParameterLookup\", \"/path/to/existing/param\"\n        )\n\n        # Output the value (for demonstration purposes)\n        cdk.CfnOutput(self, \"ExistingParameterOutput\", value=existing_param_value)\n\napp = cdk.App()\nMySsmStack(app, \"MySsmStack\",\n    env=cdk.Environment(\n        account=os.environ.get('CDK_DEFAULT_ACCOUNT', ''),\n        region=os.environ.get('CDK_DEFAULT_REGION', '')\n    )\n)\napp.synth()","lang":"python","description":"This quickstart demonstrates how to create a new String Parameter and how to look up an existing String Parameter using AWS CDK v2. It defines a simple stack that provisions an SSM parameter and then references another (presumably pre-existing) parameter. For v1, the imports would be `import aws_cdk.aws_ssm as ssm` instead of `from aws_cdk import aws_ssm` and `ssm.StringParameter` etc. [3, 13, 16, 25]"},"warnings":[{"fix":"Migrate your CDK application to AWS CDK v2. This involves changing package dependencies from individual service packages (e.g., `aws-cdk.aws-ssm`) to the consolidated `aws-cdk-lib` package and updating import statements. [15, 25, 29]","message":"The `aws-cdk-aws-ssm` package is part of AWS CDK v1, which reached End-of-Support (EoS) on June 1, 2023. It is no longer being updated. Users are strongly advised to migrate to AWS CDK v2.","severity":"breaking","affected_versions":"All versions of `aws-cdk-aws-ssm` (CDK v1)."},{"fix":"Change your import statements from `import aws_cdk.aws_ssm as ssm` (or similar v1 patterns) to `from aws_cdk import aws_ssm` when using `aws-cdk-lib`. [29]","message":"In AWS CDK v2, the construct libraries for all stable AWS services are consolidated into a single package, `aws-cdk-lib`. This changes the import paths for SSM constructs.","severity":"breaking","affected_versions":"Transitioning from AWS CDK v1 to v2."},{"fix":"For sensitive data, use AWS Secrets Manager instead, which has dedicated CDK constructs (`aws_cdk.aws_secretsmanager`). Alternatively, manually create `SecureString` parameters in the SSM console or via AWS CLI/SDK and then reference them in CDK using `from_secure_string_parameter_attributes`. [13, 15, 22, 25]","message":"AWS CDK constructs (in both v1 and v2) cannot directly create or manage `SecureString` parameters in SSM Parameter Store. Attempts to provision a `SecureString` will fail or result in a public `StringParameter`.","severity":"gotcha","affected_versions":"All AWS CDK versions (v1 and v2)."},{"fix":"For cross-region parameter lookups, define separate 'inline' CDK stacks, each configured for the specific region of the parameter, to perform the lookup. Pass the retrieved value into your main stack. [19, 20, 22]","message":"SSM Parameter Store values are region-specific. Attempting to look up a parameter in a different region from where your CDK stack is deployed will result in an error, as the parameter won't be found.","severity":"gotcha","affected_versions":"All AWS CDK versions (v1 and v2)."},{"fix":"Consider lifecycle rules for SSM parameters. For values that change frequently, it might be better to manage them outside of CDK or to implement custom update logic. If a direct update fails, a `cdk destroy` followed by `cdk deploy` might be necessary, but this will recreate the parameter and is not ideal for values that need to persist across deployments. Also consider using `cdk.CustomResource` for more granular control over parameter updates. [21]","message":"Updating the `string_value` of an `aws_ssm.StringParameter` construct via a `cdk deploy` can lead to deployment failures if CloudFormation attempts to replace the parameter rather than update its value.","severity":"gotcha","affected_versions":"All AWS CDK versions (v1 and v2)."}],"env_vars":null,"last_verified":"2026-04-16T00:00:00.000Z","next_check":"2026-07-15T00:00:00.000Z","problems":[{"fix":"Ensure you have the correct package installed for your CDK version (`pip install aws-cdk.aws-ssm` for v1 or `pip install aws-cdk-lib` for v2) and your import statements match your installed version. For CDK v2, the import should be `from aws_cdk import aws_ssm` (or `from aws_cdk.aws_ssm import ...`).","cause":"You are likely trying to import `aws_cdk.aws_ssm` (a v1 pattern) while only having `aws-cdk-lib` (v2) installed, or vice-versa, or the specific package is not installed.","error":"ModuleNotFoundError: No module named 'aws_cdk.aws_ssm'"},{"fix":"For cross-stack references, use softer dependencies like `ssm.StringParameter.value_from_lookup` instead of CloudFormation Exports, or ensure dependent stacks are updated/deleted in the correct order. For parameter value updates, review the warning regarding direct value updates. [21, 26, 28]","cause":"This often occurs when trying to update or delete an SSM parameter that is referenced by another stack (a 'hard dependency') or when attempting to update a parameter's value directly through a CDK deployment without CloudFormation recognizing it as an update.","error":"The stack named X failed to deploy: UPDATE_ROLLBACK_COMPLETE (or similar CloudFormation deployment error related to SSM parameters)"},{"fix":"Verify the parameter name and its existence in the target region and account. Ensure the IAM role used by your CDK deployment has `ssm:GetParameter` permissions. For cross-region parameters, use dedicated lookup stacks. [12, 19, 22]","cause":"The SSM parameter you are trying to reference does not exist, or your CDK execution role lacks permissions to read it, or the parameter is in a different AWS region/account than your stack.","error":"CloudFormation Error: Parameter 'YourParameterName' cannot be found. This happens if the parameter doesn't exist, you don't have permissions to access it, or it's in a different region/account."},{"fix":"Use AWS Secrets Manager constructs (`aws_cdk.aws_secretsmanager`) for creating and managing secrets. If you need to reference an existing `SecureString` from SSM, use `aws_ssm.StringParameter.from_secure_string_parameter_attributes` (but note this is for *referencing*, not *creating*). [13, 22, 25]","cause":"You are attempting to instantiate a `SecureStringParameter` class, which is not directly supported by AWS CDK for creation.","error":"TypeError: Cannot instantiate 'aws_cdk.aws_ssm.SecureStringParameter' directly."}]}