fetching ssm parameter

[BilalFakih95]

Are you certain it's a bug?

• Yes, it looks like a bug

Is the issue caused by a plugin?

• It is not a plugin issue

Are you using the latest version?

• Yes, I'm using the latest version

Is there an existing issue for this?

• I have searched existing issues, it hasn't been reported yet

Issue description

Actually, there was an issue reported before, #9597, but it was for an older version and I'm facing the same issue

When I try to deploy, I get this error message

parameter name: can't be prefixed with "ssm" (case-insensitive). if formed as a path, it can consist of sub-paths divided by slash symbol; each sub-path can be formed as a mix of letters, numbers and the following 3 symbols .-_

I tried to use plugin serverless-ssm-fetch as a walkaround but it didn't work for me

Service configuration (serverless.yml) content

provider:
    environment:
        REGION: ${self:provider.region}
        RDS_ENDPOINT: ${self:custom.databaseEndpoint}
        RDS_DB_NAME: RecruitmentServicesDB${self:custom.databaseSuffix}
        RDS_DB_USER: ----
        RDS_DB_PASSWORD: ${ssm:${self:custom.platone.project}-infrastructure-dbpassword~true}

Command name and used flags

sls deploy -s --param="priority=1234"

Command output

parameter name: can't be prefixed with "ssm" (case-insensitive). if formed as a path, it can consist of sub-paths divided by slash symbol; each sub-path can be formed as a mix of letters, numbers and the following 3 symbols .-_

Environment information

Framework Core: 3.10.0
Plugin: 6.2.1
SDK: 4.3.2

[pgrzesik]

Hello @BilalFakih95 - thanks for reporting and sorry you've run into trouble.

Could you please share how custom.platone.project is defined and what value does it resolve to? Does it resolve to a path that starts with ssm (as the error might suggest)?

[BilalFakih95]

Thanks @pgrzesik for the fast reply

custom: platone: project: onep

so basically, RDS_DB_PASSWORD would be something like this
RDS_DB_PASSWORD= ${ssm:onep-infrastructure-dbpassword~true}

In the project, we were using serverless v1 and it was working fine, and we decided to update it to v3 and that's when this issue appeared

[pgrzesik]

Thanks for sharing @BilalFakih95 - is that the only ssm variable that you use in your config? Additionally, could you paste the full error message?

[BilalFakih95]

@pgrzesik - yes that is the only place we use ssm variable in the config file
The error happens with any sls command we use

Error Message:

Running "serverless" from node_modules
Environment: linux, node 16.14.2, framework 3.12.0 (local) 3.10.0v (global), plugin 6.2.1, SDK 4.3.2
Credentials: Local, "platone-onep" profile
Docs:        docs.serverless.com
Support:     forum.serverless.com
Bugs:        github.com/serverless/serverless/issues

Error:
Cannot resolve serverless.yml: Variables resolution errored with:
  - Cannot resolve variable at "provider.environment.RDS_DB_PASSWORD": Parameter name: can't be prefixed with "ssm" (case-insensitive). If formed as a path, it can consist of sub-paths divided by slash symbol; each sub-path can be formed as a mix of letters, numbers and the following 3 symbols .-_

[pgrzesik]

Hey @BilalFakih95 - thanks for sharing more details - I've missed the ~true at the end - that should be removed and is no longer supported with v3. The variable will be automatically decrypted by default. Did you upgrade to v3 recently?

[BilalFakih95]

yes, the upgrade was done 1 week ago.
we started doing the change for the all the microservices we use in the project, the services that don't contain ssm were migrated smoothly and all sls commands are working fine, meanwhile, we have 3 services that have ssm and we're facing the same issue in those 3 services

[pgrzesik]

Thanks for clarification.

Did you try without ~true at the end? It should do the trick here.

[BilalFakih95]

yes indeed, that did the work
thanks a lot @pgrzesik for the help, I appreciate it

I'll close the issue

[pgrzesik]

I'm glad you were able to resolve you issue @BilalFakih95 🎉

[Trunksome]

Just ran into the same issue, coming from this guide: https://www.serverless.com/blog/aws-secrets-management/
FYI in case you want to update it.

[VictorioBerra]

Just ran into this issue too from that same guide https://www.serverless.com/blog/aws-secrets-management/ was very painful googling for 20 minutes to find this.