diff --git a/packages/@aws-cdk/aws-ssm/lib/parameter.ts b/packages/@aws-cdk/aws-ssm/lib/parameter.ts
index f24e4d0375108..5721cd30e922d 100644
--- a/packages/@aws-cdk/aws-ssm/lib/parameter.ts
+++ b/packages/@aws-cdk/aws-ssm/lib/parameter.ts
@@ -492,7 +492,10 @@ export class StringParameter extends ParameterBase implements IStringParameter {
    */
   public static fromSecureStringParameterAttributes(scope: Construct, id: string, attrs: SecureStringParameterAttributes): IStringParameter {
     const version = attrs.version ? Tokenization.stringifyNumber(attrs.version) : '';
-    const stringValue = new CfnDynamicReference(CfnDynamicReferenceService.SSM_SECURE, `${attrs.parameterName}:${version}`).toString();
+    const stringValue = new CfnDynamicReference(
+      CfnDynamicReferenceService.SSM_SECURE,
+      version ? `${attrs.parameterName}:${version}` : attrs.parameterName,
+    ).toString();
 
     class Import extends ParameterBase {
       public readonly parameterName = attrs.parameterName;
diff --git a/packages/@aws-cdk/aws-ssm/test/integ.parameter-store-string.lit.ts b/packages/@aws-cdk/aws-ssm/test/integ.parameter-store-string.lit.ts
index 09e0f6f17f01f..84246838ddd7d 100644
--- a/packages/@aws-cdk/aws-ssm/test/integ.parameter-store-string.lit.ts
+++ b/packages/@aws-cdk/aws-ssm/test/integ.parameter-store-string.lit.ts
@@ -38,9 +38,11 @@ class UsingStack extends cdk.Stack {
     }).stringValue;
 
     // Retrieve a specific version of the secret (SecureString) parameter.
-    // 'version' is always required.
     const secretValue = ssm.StringParameter.fromSecureStringParameterAttributes(this, 'MySecureValue', {
       parameterName: '/My/Secret/Parameter',
+    });
+    const secretValueVersion = ssm.StringParameter.fromSecureStringParameterAttributes(this, 'MySecureValueVersion', {
+      parameterName: '/My/Secret/Parameter',
       version: 5,
     });
     const secretValueVersionFromToken = ssm.StringParameter.fromSecureStringParameterAttributes(this, 'MySecureValueVersionFromToken', {
@@ -57,6 +59,7 @@ class UsingStack extends cdk.Stack {
 
     // Cannot be provisioned so cannot be actually used
     Array.isArray(secretValue);
+    Array.isArray(secretValueVersion);
     Array.isArray(secretValueVersionFromToken);
   }
 }
diff --git a/packages/@aws-cdk/aws-ssm/test/parameter.test.ts b/packages/@aws-cdk/aws-ssm/test/parameter.test.ts
index 817eb4d264239..c33bfaa01305f 100644
--- a/packages/@aws-cdk/aws-ssm/test/parameter.test.ts
+++ b/packages/@aws-cdk/aws-ssm/test/parameter.test.ts
@@ -602,7 +602,7 @@ test('StringParameter.fromSecureStringParameterAttributes without version', () =
   });
 
   // THEN
-  expect(stack.resolve(param.stringValue)).toEqual('{{resolve:ssm-secure:MyParamName:}}');
+  expect(stack.resolve(param.stringValue)).toEqual('{{resolve:ssm-secure:MyParamName}}');
 });
 
 test('StringListParameter.fromName', () => {