konokenj.cdk-api-mcp-server 0.2.0__py3-none-any.whl → 0.2.2__py3-none-any.whl

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-sqs/integ.sqs.ts

@@ -0,0 +1,51 @@
+import { AccountRootPrincipal, Role } from 'aws-cdk-lib/aws-iam';
+import { Key } from 'aws-cdk-lib/aws-kms';
+import { App, CfnOutput, RemovalPolicy, Stack } from 'aws-cdk-lib';
+import * as integ from '@aws-cdk/integ-tests-alpha';
+import { DeduplicationScope, FifoThroughputLimit, Queue, QueueEncryption } from 'aws-cdk-lib/aws-sqs';
+
+const app = new App();
+
+const stack = new Stack(app, 'aws-cdk-sqs');
+
+const dlq = new Queue(stack, 'DeadLetterQueue');
+const queue = new Queue(stack, 'Queue', {
+  deadLetterQueue: { queue: dlq, maxReceiveCount: 5 },
+  encryption: QueueEncryption.KMS_MANAGED,
+});
+const fifo = new Queue(stack, 'FifoQueue', {
+  fifo: true,
+  encryptionMasterKey: new Key(stack, 'EncryptionKey', { removalPolicy: RemovalPolicy.DESTROY }),
+});
+const highThroughputFifo = new Queue(stack, 'HighThroughputFifoQueue', {
+  fifo: true,
+  fifoThroughputLimit: FifoThroughputLimit.PER_MESSAGE_GROUP_ID,
+  deduplicationScope: DeduplicationScope.MESSAGE_GROUP,
+});
+const sqsManagedEncryptedQueue = new Queue(stack, 'SqsManagedEncryptedQueue', {
+  encryption: QueueEncryption.SQS_MANAGED,
+});
+const unencryptedQueue = new Queue(stack, 'UnencryptedQueue', {
+  encryption: QueueEncryption.UNENCRYPTED,
+});
+const ssl = new Queue(stack, 'SSLQueue', { enforceSSL: true });
+
+const role = new Role(stack, 'Role', {
+  assumedBy: new AccountRootPrincipal(),
+});
+
+dlq.grantConsumeMessages(role);
+queue.grantConsumeMessages(role);
+fifo.grantConsumeMessages(role);
+highThroughputFifo.grantConsumeMessages(role);
+sqsManagedEncryptedQueue.grantConsumeMessages(role);
+unencryptedQueue.grantConsumeMessages(role);
+ssl.grantConsumeMessages(role);
+
+new CfnOutput(stack, 'QueueUrl', { value: queue.queueUrl });
+
+new integ.IntegTest(app, 'SqsTest', {
+  testCases: [stack],
+});
+
+app.synth();

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-ssm/README.md

@@ -0,0 +1,212 @@
+# AWS Systems Manager Construct Library
+
+This module is part of the [AWS Cloud Development Kit](https://github.com/aws/aws-cdk) project.
+
+## Using existing SSM Parameters in your CDK app
+
+You can reference existing SSM Parameter Store values that you want to use in
+your CDK app by using `ssm.StringParameter.fromStringParameterAttributes`:
+
+```ts
+const parameterVersion = Token.asNumber({ Ref: 'MyParameter' });
+
+// Retrieve the latest value of the non-secret parameter
+// with name "/My/String/Parameter".
+const stringValue = ssm.StringParameter.fromStringParameterAttributes(this, 'MyValue', {
+  parameterName: '/My/Public/Parameter',
+  // 'version' can be specified but is optional.
+}).stringValue;
+const stringValueVersionFromToken = ssm.StringParameter.fromStringParameterAttributes(this, 'MyValueVersionFromToken', {
+  parameterName: '/My/Public/Parameter',
+  // parameter version from token
+  version: parameterVersion,
+}).stringValue;
+
+// Retrieve a specific version of the secret (SecureString) parameter.
+// 'version' is always required.
+const secretValue = ssm.StringParameter.fromSecureStringParameterAttributes(this, 'MySecureValue', {
+  parameterName: '/My/Secret/Parameter',
+  version: 5,
+});
+const secretValueVersionFromToken = ssm.StringParameter.fromSecureStringParameterAttributes(this, 'MySecureValueVersionFromToken', {
+  parameterName: '/My/Secret/Parameter',
+  // parameter version from token
+  version: parameterVersion,
+});
+```
+
+You can also reference an existing SSM Parameter Store value that matches an
+[AWS specific parameter type](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/parameters-section-structure.html#aws-specific-parameter-types):
+
+```ts
+ssm.StringParameter.valueForTypedStringParameterV2(this, '/My/Public/Parameter', ssm.ParameterValueType.AWS_EC2_IMAGE_ID);
+```
+
+To do the same for a SSM Parameter Store value that is stored as a list:
+
+```ts
+ssm.StringListParameter.valueForTypedListParameter(this, '/My/Public/Parameter', ssm.ParameterValueType.AWS_EC2_IMAGE_ID);
+```
+
+### Lookup existing parameters
+
+You can also use an existing parameter by looking up the parameter from the AWS environment.
+This method uses AWS API calls to lookup the value from SSM during synthesis.
+
+```ts
+const stringValue = ssm.StringParameter.valueFromLookup(this, '/My/Public/Parameter');
+```
+
+When using `valueFromLookup` an initial value of 'dummy-value-for-${parameterName}'
+(`dummy-value-for-/My/Public/Parameter` in the above example)
+is returned prior to the lookup being performed. This can lead to errors if you are using this
+value in places that require a certain format. For example if you have stored the ARN for a SNS
+topic in a SSM Parameter which you want to lookup and provide to `Topic.fromTopicArn()`
+
+```ts
+const arnLookup = ssm.StringParameter.valueFromLookup(this, '/my/topic/arn');
+sns.Topic.fromTopicArn(this, 'Topic', arnLookup);
+```
+
+Initially `arnLookup` will be equal to `dummy-value-for-/my/topic/arn` which will cause
+`Topic.fromTopicArn` to throw an error indicating that the value is not in `arn` format.
+
+For these use cases you need to handle the `dummy-value` in your code. For example:
+
+```ts
+const arnLookup = ssm.StringParameter.valueFromLookup(this, '/my/topic/arn');
+let arnLookupValue: string;
+if (arnLookup.includes('dummy-value')) {
+	arnLookupValue = this.formatArn({
+	service: 'sns',
+	resource: 'topic',
+	resourceName: arnLookup,
+	});
+
+} else {
+	arnLookupValue = arnLookup;
+}
+
+sns.Topic.fromTopicArn(this, 'Topic', arnLookupValue);
+```
+
+Alternatively, if the property supports tokens you can convert the parameter value into a token
+to be resolved _after_ the lookup has been completed.
+
+```ts
+const arnLookup = ssm.StringParameter.valueFromLookup(this, '/my/role/arn');
+iam.Role.fromRoleArn(this, 'role', Lazy.string({ produce: () => arnLookup }));
+```
+
+### cross-account SSM Parameters sharing
+
+AWS Systems Manager (SSM) Parameter Store supports cross-account sharing of parameters using the AWS Resource Access Manager (AWS RAM)
+service. In a multi-account environment, this feature enables accounts (referred to as "consuming accounts") to access and retrieve
+parameter values that are shared by other accounts (referred to as "sharing accounts"). To reference and use a shared SSM parameter
+in a consuming account, the `fromStringParameterArn()` method can be employed.
+
+The `fromStringParameterArn()` method provides a way for consuming accounts to create an instance of the StringParameter
+class from the Amazon Resource Name (ARN) of a shared SSM parameter. This allows the consuming account to retrieve and utilize the
+parameter value, even though the parameter itself is owned and managed by a different sharing account.
+
+```ts
+const sharingParameterArn = 'arn:aws:ssm:us-east-1:1234567890:parameter/dummyName';
+const sharedParam = ssm.StringParameter.fromStringParameterArn(this, 'SharedParam', sharingParameterArn);
+// the value can be accessed via sharedParam.stringValue
+```
+
+Things to note:
+
+- The account that owns the AWS Systems Manager (SSM) parameter and wants to share it with other accounts (referred to as the "sharing account") must create the parameter in the advanced tier. This is a prerequisite for sharing SSM parameters across accounts.
+
+- After creating the parameter in the advanced tier, the sharing account needs to set up a resource share using AWS Resource Access Manager (RAM). This resource share will specify the SSM parameter(s) to be shared and the accounts (referred to as "consuming accounts") with which the parameter(s) should be shared.
+
+- Once the resource share is created by the sharing account, the consuming account(s) will receive an invitation to join the resource share. For the consuming account(s) to access and use the shared SSM parameter(s), they must accept the resource share invitation from the sharing account.
+
+- The AWS Systems Manager Parameter Store parameter being referenced must be located in the same AWS region as the AWS CDK stack that is consuming or using the parameter.
+
+In summary, the process involves three main steps:
+
+1. The sharing account creates the SSM parameter(s) in the advanced tier.
+
+2. The sharing account creates a resource share using AWS RAM, specifying the SSM parameter(s) and the consuming account(s).
+
+3. The consuming account(s) accept the resource share invitation to gain access to the shared SSM parameter(s).
+
+This cross-account sharing mechanism allows for centralized management and distribution of configuration data (stored as SSM parameters) across multiple AWS accounts within an organization or between different organizations.
+
+Read [Working with shared parameters](https://docs.aws.amazon.com/systems-manager/latest/userguide/parameter-store-shared-parameters.html) for more details.
+
+## Creating new SSM Parameters in your CDK app
+
+You can create either `ssm.StringParameter` or `ssm.StringListParameter`s in
+a CDK app. These are public (not secret) values. Parameters of type
+*SecureString* cannot be created directly from a CDK application; if you want
+to provision secrets automatically, use Secrets Manager Secrets (see the
+`aws-cdk-lib/aws-secretsmanager` package).
+
+```ts
+new ssm.StringParameter(this, 'Parameter', {
+  allowedPattern: '.*',
+  description: 'The value Foo',
+  parameterName: 'FooParameter',
+  stringValue: 'Foo',
+  tier: ssm.ParameterTier.ADVANCED,
+});
+```
+
+```ts
+// Create a new SSM Parameter holding a String
+const param = new ssm.StringParameter(this, 'StringParameter', {
+  // description: 'Some user-friendly description',
+  // name: 'ParameterName',
+  stringValue: 'Initial parameter value',
+  // allowedPattern: '.*',
+});
+
+// Grant read access to some Role
+declare const role: iam.IRole;
+param.grantRead(role);
+
+// Create a new SSM Parameter holding a StringList
+const listParameter = new ssm.StringListParameter(this, 'StringListParameter', {
+  // description: 'Some user-friendly description',
+  // name: 'ParameterName',
+  stringListValue: ['Initial parameter value A', 'Initial parameter value B'],
+  // allowedPattern: '.*',
+});
+```
+
+When specifying an `allowedPattern`, the values provided as string literals
+are validated against the pattern and an exception is raised if a value
+provided does not comply.
+
+## Using Tokens in parameter name
+
+When using [CDK Tokens](https://docs.aws.amazon.com/cdk/v2/guide/tokens.html) in parameter name,
+you need to explicitly set the `simpleName` property. Setting `simpleName` to an incorrect boolean
+value may result in unexpected behaviours, such as having duplicate '/' in the parameter ARN
+or missing a '/' in the parameter ARN.
+
+`simpleName` is used to indicates whether the parameter name is a simple name. A parameter name
+without any '/' is considered a simple name, thus you should set `simpleName` to `true`.
+If the parameter name includes '/', set `simpleName` to `false`.
+
+```ts
+import * as lambda from 'aws-cdk-lib/aws-lambda';
+
+const simpleParameter = new ssm.StringParameter(this, 'StringParameter', {
+  // the parameter name doesn't contain any '/'
+  parameterName: 'parameter',
+  stringValue: 'SOME_VALUE',
+  simpleName: true, // set `simpleName` to true
+});
+
+declare const func: lambda.IFunction;
+const nonSimpleParameter = new ssm.StringParameter(this, 'StringParameter', {
+  // the parameter name contains '/'
+  parameterName: `/${func.functionName}/my/app/param`,
+  stringValue: 'SOME_VALUE',
+  simpleName: false, // set `simpleName` to false
+});
+```

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-ssm/integ.import-parameter.ts

@@ -0,0 +1,48 @@
+import * as cdk from 'aws-cdk-lib';
+import { IntegTest } from '@aws-cdk/integ-tests-alpha';
+import * as ssm from 'aws-cdk-lib/aws-ssm';
+
+const app = new cdk.App();
+const stack = new cdk.Stack(app, 'Import-SSM-Parameter');
+
+const parameterName = 'import-parameter-test';
+
+const param = new ssm.StringParameter(stack, 'StringParameter', {
+  stringValue: 'Initial parameter value',
+  parameterName,
+});
+
+// This will use a CfnParameter.
+// We have to use an existing parameter to reference it with a concrete name, so using a parameter managed by EC2.
+const importedWithName = ssm.StringParameter.fromStringParameterAttributes(stack, 'ImportedWithName', {
+  parameterName: '/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-ebs',
+});
+
+// This will use a dynamic reference (deduced).
+const importedWithIntrinsic = ssm.StringParameter.fromStringParameterAttributes(stack, 'ImportedWithIntrinsic', {
+  simpleName: true,
+  parameterName: cdk.Fn.ref((param.node.defaultChild as cdk.CfnResource).logicalId),
+});
+
+// This will use a dynamic reference (forced).
+const importedWithForceFlag = ssm.StringParameter.fromStringParameterAttributes(stack, 'ImportedWithForceFlag', {
+  simpleName: true,
+  parameterName: param.parameterName,
+  forceDynamicReference: true,
+});
+
+new cdk.CfnOutput(stack, 'ImportedWithNameOutput', {
+  value: importedWithName.stringValue,
+});
+
+new cdk.CfnOutput(stack, 'ImportedWithIntrinsicOutput', {
+  value: importedWithIntrinsic.stringValue,
+});
+
+new cdk.CfnOutput(stack, 'ImportedWithForceFlagOutput', {
+  value: importedWithForceFlag.stringValue,
+});
+
+new IntegTest(app, 'cdk-integ-import-ssm-parameter', {
+  testCases: [stack],
+});

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-ssm/integ.list-parameter.ts

@@ -0,0 +1,82 @@
+import * as cdk from 'aws-cdk-lib';
+import { IntegTest, ExpectedResult, Match } from '@aws-cdk/integ-tests-alpha';
+import { Construct } from 'constructs';
+import * as ssm from 'aws-cdk-lib/aws-ssm';
+const paramName = 'integ-list-param';
+const paramValue = ['value1', 'value2'];
+
+class TestCaseBase extends cdk.Stack {
+  public readonly listParam: ssm.IStringListParameter;
+  constructor(scope: Construct, id: string) {
+    super(scope, id);
+
+    this.listParam = new ssm.StringListParameter(this, 'ListParam', {
+      parameterName: paramName,
+      stringListValue: paramValue,
+    });
+  }
+}
+
+const app = new cdk.App({
+  treeMetadata: false,
+});
+app.node.setContext('@aws-cdk/core:newStyleStackSynthesis', true);
+const base = new TestCaseBase(app, 'base');
+const testCase = new cdk.Stack(app, 'list-param');
+
+// creates the dependency between stacks
+new cdk.CfnOutput(testCase, 'Output', {
+  value: cdk.Fn.join(',', base.listParam.stringListValue),
+});
+
+/**
+ * get the value from the `base` stack and then write it to a new parameter
+ * We will then assert that the value that is written is the correct value
+ * This validates that the `fromXXX` and `valueForXXX` imports the value correctly
+ */
+
+const fromAttrs = ssm.StringListParameter.fromListParameterAttributes(testCase, 'FromAttrs', {
+  parameterName: paramName,
+  elementType: ssm.ParameterValueType.STRING,
+});
+const ssmAttrsValue = new ssm.CfnParameter(testCase, 'attrs-test', {
+  type: 'StringList',
+  value: cdk.Fn.join(',', fromAttrs.stringListValue),
+});
+
+const value = ssm.StringListParameter.valueForTypedListParameter(testCase, paramName, ssm.ParameterValueType.STRING);
+const ssmValue = new ssm.CfnParameter(testCase, 'value-test', {
+  type: 'StringList',
+  value: cdk.Fn.join(',', value),
+});
+
+const versionValue = ssm.StringListParameter.valueForTypedListParameter(testCase, paramName, ssm.ParameterValueType.STRING, 1);
+const ssmVersionValue = new ssm.CfnParameter(testCase, 'version-value-test', {
+  type: 'StringList',
+  value: cdk.Fn.join(',', versionValue),
+});
+
+const integ = new IntegTest(app, 'ssm-string-param', {
+  testCases: [
+    testCase,
+  ],
+});
+
+// list the parameters
+const actualAttrs = integ.assertions.awsApiCall('SSM', 'getParameters', {
+  Names: [ssmVersionValue.ref, ssmValue.ref, ssmAttrsValue.ref],
+});
+
+actualAttrs.expect(ExpectedResult.objectLike({
+  Parameters: Match.arrayWith([
+    Match.objectLike({
+      Value: paramValue.join(','),
+    }),
+    Match.objectLike({
+      Value: paramValue.join(','),
+    }),
+    Match.objectLike({
+      Value: paramValue.join(','),
+    }),
+  ]),
+}));

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-ssm/integ.parameter-arns.ts

@@ -0,0 +1,27 @@
+import { App, CfnOutput, CfnParameter, Stack } from 'aws-cdk-lib';
+import { IntegTest } from '@aws-cdk/integ-tests-alpha';
+import * as ssm from 'aws-cdk-lib/aws-ssm';
+
+const app = new App();
+const stack = new Stack(app, 'integ-parameter-arns');
+
+const input = new CfnParameter(stack, 'ParameterNameParameter', { type: 'String', default: 'myParamName' });
+
+const params = [
+  new ssm.StringParameter(stack, 'StringAutogen', { stringValue: 'hello, world' }),
+  new ssm.StringParameter(stack, 'StringSimple', { stringValue: 'hello, world', parameterName: 'simple-name' }),
+  new ssm.StringParameter(stack, 'StringPath', { stringValue: 'hello, world', parameterName: '/path/name/foo/bar' }),
+  new ssm.StringListParameter(stack, 'ListAutogen', { stringListValue: ['hello', 'world'] }),
+  new ssm.StringListParameter(stack, 'ListSimple', { stringListValue: ['hello', 'world'], parameterName: 'list-simple-name' }),
+  new ssm.StringListParameter(stack, 'ListPath', { stringListValue: ['hello', 'world'], parameterName: '/list/path/name' }),
+  new ssm.StringParameter(stack, 'ParameterizedSimple', { stringValue: 'hello, world', parameterName: input.valueAsString, simpleName: true }),
+  new ssm.StringParameter(stack, 'ParameterizedNonSimple', { stringValue: 'hello, world', parameterName: `/${input.valueAsString}/non/simple`, simpleName: false }),
+];
+
+for (const p of params) {
+  new CfnOutput(stack, `${p.node.id}Arn`, { value: p.parameterArn });
+}
+
+new IntegTest(app, 'cdk-integ-ssm-parameter-arns', {
+  testCases: [stack],
+});

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-ssm/integ.parameter-store-string-sharing.ts

@@ -0,0 +1,138 @@
+import * as cdk from 'aws-cdk-lib';
+import * as integ from '@aws-cdk/integ-tests-alpha';
+import {
+  aws_ssm as ssm,
+  aws_ram as ram,
+  StackProps,
+} from 'aws-cdk-lib';
+
+/**
+ * This integration test requires two accounts with an AWS SSM Parameter created from the producing account,
+ * sharing with the consuming account, which would accept the sharing invitation and consume the shared parameter
+ * in its consuming stack.
+ *
+ * To test it locally:
+ *
+ * $ export CDK_INTEG_ACCOUNT=<AWS_ACCOUNT_PRODUCING>
+ * $ export CDK_INTEG_CROSS_ACCOUNT=<AWS_ACCOUNT_CONSUMING>
+ *
+ * And run:
+ *
+ * $ yarn integ test/aws-ssm/test/integ.parameter-store-string-sharing.js --update-on-failed
+ *
+ * The `producing` stack would be created from the sharing account in `us-east-1` followed by the `accepting` and `consuming` stacks
+ * being created from the comsuming account in the same region.
+ *
+ * `stackUpdateWorkflow` has to be disabled as the accepting stack can not re-accept the sharing invite.
+ *
+ */
+
+export interface ProducingStackProps extends StackProps {
+  readonly sharingToAccount: string;
+  readonly parameterName: string;
+}
+
+class ProducingStack extends cdk.Stack {
+  readonly resourceShareArn: string;
+  readonly parameterArn: string;
+  constructor(scope: cdk.App, id: string, props: ProducingStackProps) {
+    super(scope, id, props);
+
+    const publicParameter = new ssm.StringParameter(this, 'String', {
+      parameterName,
+      stringValue: 'Abc123',
+      tier: ssm.ParameterTier.ADVANCED,
+    });
+
+    this.parameterArn = publicParameter.parameterArn;
+
+    // create resource share
+    const share = new ram.CfnResourceShare(this, 'ParamShare', {
+      name: 'ParamShare',
+      allowExternalPrincipals: true,
+      principals: [props.sharingToAccount],
+      resourceArns: [this.parameterArn],
+      permissionArns: [
+        'arn:aws:ram::aws:permission/AWSRAMDefaultPermissionSSMParameterReadOnly',
+      ],
+    });
+
+    this.resourceShareArn = share.attrArn;
+    new cdk.CfnOutput(this, 'ResourceShareArn', { value: this.resourceShareArn });
+    new cdk.CfnOutput(this, 'ParameterArn', { value: this.parameterArn });
+
+    share.node.addDependency(publicParameter);
+  }
+}
+class AcceptingStack extends cdk.Stack {
+  constructor(scope: cdk.App, id: string, props: StackProps) {
+    super(scope, id, props);
+
+    const apicallResource = new integ.AwsApiCall(this, 'GetResourceShareInvitations', {
+      service: 'RAM',
+      api: 'getResourceShareInvitations',
+      outputPaths: ['resourceShareInvitations.0'],
+    });
+
+    const resourceShareInvitationArn = apicallResource.getAttString('resourceShareInvitations.0.resourceShareInvitationArn');
+    new cdk.CfnOutput(this, 'resourceShareInvitationArnOutput', {
+      value: resourceShareInvitationArn,
+    });
+
+    // accept the invitation
+    new integ.AwsApiCall(this, 'AcceptResourceShareInvitation', {
+      service: 'RAM',
+      api: 'acceptResourceShareInvitation',
+      parameters: {
+        resourceShareInvitationArn,
+      },
+    });
+  }
+}
+
+export interface ConsumingStackProps extends StackProps {
+  readonly parameterArn: string;
+}
+
+class ConsumingStack extends cdk.Stack {
+  constructor(scope: cdk.App, id: string, props: ConsumingStackProps) {
+    super(scope, id, props);
+
+    // now we should be allowed to get the remote parameter
+    const remoteParam = ssm.StringParameter.fromStringParameterArn(this, 'RemoteParam', props.parameterArn);
+
+    // should Output `Abc123`
+    new cdk.CfnOutput(this, 'RemoteParameterValueOutput', { value: remoteParam.stringValue });
+  }
+}
+
+const app = new cdk.App();
+
+const account = process.env.CDK_INTEG_ACCOUNT || process.env.CDK_DEFAULT_ACCOUNT || '123456789012'; // The account sharing the parameter.
+const crossAccount = process.env.CDK_INTEG_CROSS_ACCOUNT || '234567890123'; // The account that comsumes the parameter.
+const parameterName = '/My/Public/Parameter';
+
+const producing = new ProducingStack(app, 'integ-ssmps-sharing-producing', {
+  env: { account: account, region: 'us-east-1' },
+  sharingToAccount: crossAccount,
+  parameterName,
+});
+
+const accepting = new AcceptingStack(app, 'integ-ssmps-sharing-accepting', {
+  env: { account: crossAccount, region: 'us-east-1' },
+});
+
+const consuming = new ConsumingStack(app, 'integ-ssmps-sharing-consuming', {
+  env: { account: crossAccount, region: 'us-east-1' },
+  parameterArn: `arn:aws:ssm:us-east-1:${account}:parameter${parameterName}`,
+});
+
+accepting.addDependency(producing);
+consuming.addDependency(accepting);
+
+new integ.IntegTest(app, 'SSMParameterStoreSharingTest', {
+  // this would first deploy `producing` then `accepting` and finally `consuming`
+  testCases: [consuming],
+  // skip the update workflow to avoid re-accepting the invitation error
+  stackUpdateWorkflow: false,
+});

cdk_api_mcp_server/resources/aws-cdk/constructs/aws-cdk-lib/aws-ssm/integ.parameter-store-string.ts

@@ -0,0 +1,100 @@
+import * as cdk from 'aws-cdk-lib';
+import * as integ from '@aws-cdk/integ-tests-alpha';
+import * as ssm from 'aws-cdk-lib/aws-ssm';
+
+const SECURE_PARAM_NAME = '/My/Secret/Parameter';
+
+class CreatingStack extends cdk.Stack {
+  constructor(scope: cdk.App, id: string) {
+    super(scope, id);
+
+    new ssm.StringParameter(this, 'String', {
+      parameterName: '/My/Public/Parameter',
+      stringValue: 'Abc123',
+    });
+
+    new integ.AwsApiCall(this, 'SecureParam', {
+      service: 'SSM',
+      api: 'putParameter',
+      parameters: {
+        Name: SECURE_PARAM_NAME,
+        Type: 'SecureString',
+        Value: 'Abc123',
+      },
+    });
+  }
+}
+
+class UsingStack extends cdk.Stack {
+  constructor(scope: cdk.App, id: string) {
+    super(scope, id);
+
+    // Parameter that contains version number, will be used to pass
+    // version value from token.
+    const parameterVersion = new cdk.CfnParameter(this, 'MyParameterVersion', {
+      type: 'Number',
+      default: 1,
+    }).valueAsNumber;
+
+    // Retrieve the latest value of the non-secret parameter
+    // with name "/My/String/Parameter".
+    const stringValue = ssm.StringParameter.fromStringParameterAttributes(this, 'MyValue', {
+      parameterName: '/My/Public/Parameter',
+      // 'version' can be specified but is optional.
+    }).stringValue;
+    const stringValueVersionFromToken = ssm.StringParameter.fromStringParameterAttributes(this, 'MyValueVersionFromToken', {
+      parameterName: '/My/Public/Parameter',
+      // parameter version from token
+      version: parameterVersion,
+    }).stringValue;
+
+    // Retrieve a specific version of the secret (SecureString) parameter.
+    const secretValue = ssm.StringParameter.fromSecureStringParameterAttributes(this, 'MySecureValue', {
+      parameterName: '/My/Secret/Parameter',
+    }).stringValue;
+    const secretValueVersion = ssm.StringParameter.fromSecureStringParameterAttributes(this, 'MySecureValueVersion', {
+      parameterName: '/My/Secret/Parameter',
+      version: 1,
+    }).stringValue;
+    const secretValueVersionFromToken = ssm.StringParameter.fromSecureStringParameterAttributes(this, 'MySecureValueVersionFromToken', {
+      parameterName: '/My/Secret/Parameter',
+      // parameter version from token
+      version: parameterVersion,
+    }).stringValue;
+
+    const user = new cdk.CfnResource(this, 'DummyResourceUsingStringParameters', {
+      type: 'AWS::IAM::User',
+      properties: {
+        LoginProfile: {
+          Password: cdk.Fn.join('-', [
+            stringValue,
+            stringValueVersionFromToken,
+            secretValue,
+            secretValueVersion,
+            secretValueVersionFromToken,
+          ]),
+        },
+      },
+    });
+    user.applyRemovalPolicy(cdk.RemovalPolicy.DESTROY);
+  }
+}
+
+const app = new cdk.App();
+
+const creating = new CreatingStack(app, 'sspms-creating');
+
+const using = new UsingStack(app, 'sspms-using');
+using.addDependency(creating);
+
+const cleanup = new cdk.Stack(app, 'sspms-cleanup');
+cleanup.addDependency(using);
+
+const integTest = new integ.IntegTest(app, 'SSMParameterStoreTest', {
+  assertionStack: cleanup,
+  testCases: [using],
+});
+
+integTest.assertions.awsApiCall('SSM', 'deleteParameter', {
+  Name: SECURE_PARAM_NAME,
+});