Skip to content

SSM: resolve full parameter ARNs in get_parameters (#9396) - #10120

Open
balramthewarrior wants to merge 2 commits into
getmoto:masterfrom
balramthewarrior:fix-9396-get-parameters-arn
Open

SSM: resolve full parameter ARNs in get_parameters (#9396)#10120
balramthewarrior wants to merge 2 commits into
getmoto:masterfrom
balramthewarrior:fix-9396-get-parameters-arn

Conversation

@balramthewarrior

Copy link
Copy Markdown

Partially addresses #9396.

Problem

get_parameter accepts a full parameter ARN — that was fixed in #7748. get_parameters was not updated to match, so reading parameters by ARN (as you do for a parameter shared from another account via RAM) silently returns nothing:

arn = f"arn:aws:ssm:{region}:{account}:parameter/Parameter1"
client.get_parameter(Name=arn)      # works
client.get_parameters(Names=[arn])  # {} + the ARN listed in InvalidParameters

The cause is the guard in get_parameters:

if name.split(":")[0] in self._parameters:

For an ARN, name.split(":")[0] is "arn", which is never a stored parameter name, so the entry is skipped before get_parameter (which would have handled the ARN) is ever called.

Change

Extract the prefix-stripping already present in get_parameter into _strip_parameter_arn, and use it in the get_parameters guard as well.

The caller's original string stays the dict key, so the response layer still reports InvalidParameters using exactly what was requested rather than a stripped name — there's a test for that. Name in the returned parameter is the bare name, matching the existing get_parameter-by-ARN behaviour.

Tests

Against unpatched master these give 2 failed / 1 passed; the by-name case passes either way. Full tests/test_ssm/ suite: 181 passed. mypy and ruff check clean.

Not covered by this PR

Two other things reported in #9396:

  • create_resource_share still rejects SSM parameters — SHAREABLE_RESOURCES in moto/ram/models.py has no "parameter" entry. Adding the string is trivial, but AWS only permits sharing Advanced-tier parameters, and RAM has no visibility into SSM state to enforce that. Happy to do it if you have a preference on how strict it should be.
  • The reported missing Tier on put_parameter appears to be a non-issue — Tier is stored and returned in response_object on current master.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant