How to pass a SecureString parameter to a command in State Manager association

Question

I created a SecureString parameter in AWS Systems Manager Parameter Store. It uses the default KMS key for encryption/decryption. I also created an association in State Manager to run "AWS-RunPowerShellScript" using the command "Net.exe user administrator {{ssh:<name of my parameter>}}" to have State Manager update the password across all of my associated Windows EC2 instances. However, the update only works when I reference a String parameter but does NOT work when I reference a SecureString parameter.

Any ideas why I can't reference a SecureString parameter? How do I reference a SecureString parameter in this State Manager association?

Accepted Answer

https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-param-runcommand.html

SSM documents don't support references to SecureString parameters. This means that to use SecureString parameters with, for example, Run Command, you have to retrieve the parameter value before passing it to Run Command.

How to pass a SecureString parameter to a command in State Manager association

Relevant content