aws-systems-manager | Artifacts for use with AWS Systems Manager | DevOps library

I am attempting to deploy a CloudFormation template that pulls in some parameters from SSM using the method described in this blog-post: https://aws.amazon.com/blogs/mt/integrating-aws-cloudformation-with-aws-systems-manager-parameter-store/

The relevant excerpt from the Parameters section of the CF template is:

I am using AWS Systems Manager Parameter Store to hold database connection strings which are used to dynamically build a DbContext in my .NET Core Application

I am using the .NET Core AWS configuration provider (from https://aws.amazon.com/blogs/developer/net-core-configuration-provider-for-aws-systems-manager/) which injects my parameters into the IConfiguration at runtime.

At the moment I am having to keep my AWS access key/secret in code so it can be accessed by the ConfigurationBuilder but would like to move this out of the code base and stored it in appsettings or similar.

Here is my method to create the webhost builder called at startup

I have a multi account structure in AWS, where I have a master and child accounts. I am following this guide in order to propagate tags from the child instances to the master account, once they have been activated and I can manage the instances in the master account (systems manager).

So far it all works to the point where the lambda in the master account has all of the tags it needs. However, it is unable to add the tags to the managed instances in systems manager. Not sure why the role still can't access the tags, given the permissions...

This is the error I get:

I'm currently dealing with an annoying issue:

We are storing some environment (dev/test/prod/etc) specific parameter values in SSM Parameter Store, as such they have different names. They change fairly often.

The environment is being passed to update-stack as a CF template parameter, and I'd like to construct the actual SSM parameter name from that (this is the blog post I'm referencing: https://aws.amazon.com/blogs/mt/integrating-aws-cloudformation-with-aws-systems-manager-parameter-store/)

I really want to use a single generic parameter in my Cloudformation template, however, that does not seem to be possible because the values of the parameters need to be hardcoded. And you can't seem to !Ref a !Join statement.

Anyone out there done something similar and found a good workaround?

Is there any managed policy similar to DynamoDBReadPolicy for the ssm:GetParameter* permission for a Lambda function? I'm using aws-sam-cli and trying to follow this, but when I try to fetch the parameters when using sam local start-api, I get the following error:

InvalidAction: The action or operation requested is invalid. Verify that the action is typed correctly.

Here is the snippet where I try to get the parameter: