Aws-cdk: Failed to create ssm association

[abelmokadem]

:bug: Bug Report

What is the problem?

I'm unable to use ssm.CfnAssociation to create an association in systems manager. There seems to be something wrong with the parameters field.

Reproduction Steps

This does not work:

    const association = new ssm.CfnAssociation(this, "Association", {
      targets: [
        {
          key: "InstanceIds",
          values: [instance.instanceId]
        }
      ],
      parameters: {
        dnsIpAddresses: {
          parameterValues: props.microsoftAd.attrDnsIpAddresses
        },
        directoryName: {
          parameterValues: [props.microsoftAdHostName]
        },
        directoryId: {
          parameterValues: [props.microsoftAd.ref]
        }
      },
      name: document.ref
    });

This works fine:

    const association = new cdk.CfnResource(this, "Association", {
      type: "AWS::SSM::Association",
      properties: {
        Targets: [
          {
            Key: "InstanceIds",
            Values: [instance.instanceId]
          }
        ],
        Parameters: {
          dnsIpAddresses: props.microsoftAd.attrDnsIpAddresses,
          directoryName: [props.microsoftAdHostName],
          directoryId: [props.microsoftAd.ref]
        },
        Name: document.ref
      }
    });

Verbose Log

 6/15 | 07:35:46 | CREATE_FAILED        | AWS::SSM::Association                 | WindowsBastion/Association (WindowsBastionAssociationC8296AE5) Value of {Parameters} must be a map where each value is a list of {String}
        new WindowsBastion (/Users/ash/Projects/VFZiggo/bicc/infrastructure/bicc/lib/central-vpc-mock-stack/windows-bastion.ts:121:25)
        \_ new CentralVpcMockStack (/Users/ash/Projects/VFZiggo/bicc/infrastructure/bicc/lib/central-vpc-mock-stack/index.ts:91:28)
        \_ Object.<anonymous> (/Users/ash/Projects/VFZiggo/bicc/infrastructure/bicc/bin/bicc.ts:29:29)
        \_ Module._compile (module.js:652:30)
        \_ Module.m._compile (/Users/ash/Projects/VFZiggo/bicc/infrastructure/bicc/node_modules/ts-node/src/index.ts:473:23)
        \_ Module._extensions..js (module.js:663:10)
        \_ Object.require.extensions.(anonymous function) [as .ts] (/Users/ash/Projects/VFZiggo/bicc/infrastructure/bicc/node_modules/ts-node/src/index.ts:476:12)
        \_ Module.load (module.js:565:32)
        \_ tryModuleLoad (module.js:505:12)
        \_ Function.Module._load (module.js:497:3)
        \_ Function.Module.runMain (module.js:693:10)
        \_ Object.<anonymous> (/Users/ash/Projects/VFZiggo/bicc/infrastructure/bicc/node_modules/ts-node/src/bin.ts:158:12)
        \_ Module._compile (module.js:652:30)
        \_ Object.Module._extensions..js (module.js:663:10)
        \_ Module.load (module.js:565:32)
        \_ tryModuleLoad (module.js:505:12)
        \_ Function.Module._load (module.js:497:3)
        \_ Function.Module.runMain (module.js:693:10)
        \_ findNodeScript.then.existing (/Users/ash/.nvm/versions/node/v8.10.0/lib/node_modules/npm/node_modules/libnpx/index.js:268:14)
        \_ <anonymous>

Environment

• CDK CLI Version: 1.8.0
• Module Version: 1.8.0
• OS: macOS Sierra
• Language: TypeScript

Other information

[nmussy]

I think there might be something wrong with the CloudFormation specs. ParameterValues are defined with the fixed parameterValues key, like your failing first example.

However, the examples at the end of AWS::SSM::Association use the same format as your second, working example, without the key:

        "Parameters": {
          "Directory": ["myWorkSpace"]
        }

[eladb]

@abelmokadem can you please paste the AWS::SSM::Association resource from the synthesized cloudformation template?

[abelmokadem]

    "CfnAssociation": {
      "Type": "AWS::SSM::Association",
      "Properties": {
        "Name": {
          "Ref": "CentralNodeCommandsCentralNodeBootstrapV003215C854A8"
        },
        "Parameters": {
          "dnsIpAddresses": {
            "ParameterValues": [
              "foo"
            ]
          }
        },
        "Targets": [
          {
            "Key": "InstanceIds",
            "Values": [
              "test-id"
            ]
          }
        ]
      },
      "Metadata": {
        "aws:cdk:path": "BiccQlikSenseOnWindowsStagingStack/CentralNodeCommands/CfnAssociation"
      }
    },
    "CfnResource": {
      "Type": "AWS::SSM::Association",
      "Properties": {
        "Targets": [
          {
            "Key": "InstanceIds",
            "Values": [
              "test-id"
            ]
          }
        ],
        "Parameters": {
          "dnsIpAddresses": [
            "foo"
          ]
        },
        "Name": {
          "Ref": "CentralNodeCommandsCentralNodeBootstrapV003215C854A8"
        }
      },
      "Metadata": {
        "aws:cdk:path": "BiccQlikSenseOnWindowsStagingStack/CentralNodeCommands/CfnResource"
      }
    },

[eladb]

Internal ticket: CFN-29115

[eladb]

As a workaround, you should be able to use an escape hatch (association.addPropertyOverride) to render the correct output (without the ParameterValues key). LMK if you need help to get this to work.

[abelmokadem]

@eladb I'm using CfnResource for now. This is working fine for me. Looking forward to seeing this get fixed. :)

[kuhnboy]

@eladb this is a duplicte of https://github.com/aws/aws-cdk/issues/3092

[udondan]

Thanks for the hint.

I got it working with an override:

association.addOverride('Properties.Parameters.Foo', ['Bar']);

[h1f1x]

Is this bug gonna be fixed soonish? Can't track the chain .... The source seems to stick around since May or longer!