aws_ssm: valueForSecureStringParameter is deprecated and the alternative isn't clearly documented

[trondhindenes]

Describe the issue

From here:
https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ssm.StringParameter.html#static-valuewbrforwbrsecurewbrstringwbrparameterscope-parametername-versionspan-classapi-icon-api-icon-deprecated-titlethis-api-element-is-deprecated-its-use-is-not-recommended%EF%B8%8Fspan

This text, for valueForSecureStringParameter:

Deprecated: Use SecretValue.ssmSecure() instead, it will correctly type the imported value as a SecretValue and allow importing without version.

There's no mention of what SecretValue.ssmSecure() is, which module it belongs to or how to use it. The documentation should point properly point to a non-deprecated alternative.

Links

https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ssm.StringParameter.html#static-valuewbrforwbrsecurewbrstringwbrparameterscope-parametername-versionspan-classapi-icon-api-icon-deprecated-titlethis-api-element-is-deprecated-its-use-is-not-recommended%EF%B8%8Fspan

[MG-hynesnd]

Hi, noting that this is still an issue and that use of SecretValue.ssmSecure() as a replacement for valueForSecureStringParameter is still not clearly documented.

The cdk documentation page on getting SSM values, here doesn't mention that valueForSecureStringParameter is deprecated. So this doesn't become clear until attempting to use it and finding it marked deprecated.

I'm struggling to find any documentation of how to properly use SecretValue:

• The API reference page for valueForSecureStringParameter does not link to the recommended CDK v2 replacement SecretValue.ssmSecure().
• Googling SecretValue.ssmSecure() leads to a CDK v1 API reference page.
• This page contains a link to the CDK v2 version of SecretValue. But this page is a bit light on context for how to properly adopt and use it.
• No usage example for fetching a secure SSM parameter.

[damolaobaleke]

Same, still not properly documented. Struggling to find any documentation on SecretValue and what module its coming from

[damolaobaleke]

Actually I've figured it out so its in the @aws-cdk/core module. @trondhindenes @MG-hynesnd

Usage:

const awscdkCore = require('@aws-cdk/core');
const secret = awscdkCore.SecretValue.ssmSecure('SECRET_VALUE', 'version')

You can check out this link for the class and its methods within it.
https://docs.aws.amazon.com/cdk/api/v1/docs/@aws-cdk_core.SecretValue.html#static-ssmwbrsecureparametername-version

[Zishanwang1992]

I would like to work on this issue as my first issue.

It looks like we can add a link to reference the recommended CDK v2 replacement SecretValue.ssmSecure(). Here is the link that I found.

Let me know if there is any concern or suggestion!

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.