[SSM] How to always get latest version of Secure String in Parameter Store

❓ General Issue

The Question

My team will automatically update SecureString in ParameterStore via CLI, but in CDK, I couldn’t / find any way to get around Cloudformation limitation, or workaround (just work) method to always force get the latest version while using DBInstance.

Environment

• CDK CLI Version: 1.59.0
• Module Version: 1.59.0
• Node.js Version: 14.8.0
• OS: OSX Catalina
• Language (Version): TypeScript (3.9.7)

Other information

Sample code:

const sqlInstance = new DatabaseInstance(this, `Sql-${opt.stage}`, {
      engine: DatabaseInstanceEngine.POSTGRES,
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE2, ec2.InstanceSize.SMALL),
      masterUsername: SQL_USER_NAME,
      masterUserPassword: ssm.StringParameter.valueForSecureStringParameter(this, "${opt.stage}/SQL_PASSWORD", 
"<Hope I can always get latest version number....>"),
})

[spyoungtech]

It would be nice if the version were not required to use a secure string parameter with the Secret construct because it’s not required for the cloudformation definition.

[fengkaijia]

Can we reopen this so that the AWS team knows currently there’s only a workaround but no solution yet?