Skip to content

Testing of cross-account SSM parameters doesn't seem to be working #9396

@AdamLuchjenbroers

Description

@AdamLuchjenbroers

I'm trying to write a test case that tests fetching SSM parameter information across accounts. I'm mocking this up by setting MOTO_ACCOUNT_ID to create SSM parameters in the target account, creating the RAM share to let it view across accounts. I seem to be encountering a few issues here:

    monkeypatch.setenv('MOTO_ACCOUNT_ID', '222222222222')
    response = ssm.put_parameter(
        Name='/Parameter1',
        Value='Value1',
        Type='String',
        Tier='Advanced'
    )
    print(f"Created Parameter #1: {response}")
    response = ssm.put_parameter(
        Name='/Parameter2',
        Value='Value2',
        Type='String',
        Tier='Advanced'
    )
    print(f"Created Parameter #2: {response}")
    ram.create_resource_share(
        name='ShareTest',
        resourceArns=[
            "arn:aws:ssm:ap-southeast-2:222222222222:parameter/Parameter1",
            "arn:aws:ssm:ap-southeast-2:222222222222:parameter/Parameter2"
        ],
        principals=[
            '111111111111'
        ]
    )

    monkeypatch.setenv('MOTO_ACCOUNT_ID', '111111111111')
    # Do testing
  • get_parameters doesn't seem to support fetching using the full ARN (it looks like get_parameter was fixed by SSM.Client.get_parameter() by ARN instead of Name fails with ParameterNotFound #7748, but this fix didn't touch related methods).
  • get_parameter works by ARN when I don't change the MOTO_ACCOUNT_ID environment variable but breaks otherwise (this could be correct behaviour, as there is an issue creating a RAM resource share for these parameters - but see below).
  • create_resource_share fails with You cannot share the selected resource type. despite the parameters being configured as 'Advanced'. One potentially related observation here is that 'Tier' isn't returned by the put_parameter API call despite it being expected according to the Boto3 documentation (which suggests to me that this isn't currently being captured, and only Advanced tier parameters can be used with RAM according to AWS documentation).

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions