SSM Secure Parameter Version ignored in ARN

We create a secure string parameter in SSM and pass it down to an ECS service via a TaskDefinition (inside a ContainerDefinition) as Secret. However, the version of the secure string seems to be ignored when the CloudFormation ARN for the secret in the ECS task definition is created.

Reproduction Steps

const param = StringParameter.fromSecureStringParameterAttributes(construct, "SecretParameterForEcsTaskDefinition" {
     simpleName: false,
     parameterName: "some-name",
     version: 2,
});

const secret = Secret.fromSsmParameter(param);
// pass the secret to ECS task definition via secrets property
...
const options: ContainerDefinitionOptions = {
    ...
    secrets: {
      "some-key": secret,
    }
}

Error Log

Not an error, but the parameter version is not pinned. The ECS task definition contains the following:

...
"secrets": [
        {
          "valueFrom": "arn:aws:ssm:eu-central-1:xxxxxxxxxx:parameter/some-name",
          "name": "some-key"
        }
]

I would expect the ARN to end with: some-name:2.

Environment

• CLI Version : 1.39.0 (build 5d727c1)
• Framework Version: 1.39.0
• Node.js Version: v12.16.3
• OS : Linux
• Language (Version): TypeScript

---

This is 🐛 Bug Report

[jnawk]

I did a bit of digging, it appears one can’t specify the version of a SSM Parameter in a task def, so no amount of wishing in the CDK will make it happen. One either needs to use Secrets Manager (which one can (must) specify versions for), or the ECS service itself needs to be changed to support passing in SSM parameter versions.

[Nevon]

This is the corresponding feature request on the containers roadmap https://github.com/aws/containers-roadmap/issues/636

It was closed after implementing support for versioned secrets for Secret Store, but not SSM Parameters.