AWS custom resources in the AWS CDK allow us to achieve functionality that might not be available otherwise. In this case, I needed a secure string parameter to be converted to a string that I could pass directly to a bash script. Any of the other lookups resulted in an error, as it would pass either the token itself or the encrypted string.

aws-custom-resource-example.ts

import { AwsCustomResource, AwsCustomResourcePolicy, PhysicalResourceId } from '@aws-cdk/custom-resources'

/**
 * Secure string from Parameter store
 */
const getParameter = new AwsCustomResource(this, 'SsmSecureStringParameter', {
  onUpdate: {
    service: 'SSM',
    action: 'getParameter',
    parameters: {
      Name: this.node.tryGetContext('secureStringParameter'),
      WithDecryption: true,
    },
    physicalResourceId: PhysicalResourceId.of(Date.now().toString()),
  },
  policy: AwsCustomResourcePolicy.fromSdkCalls({
    resources: AwsCustomResourcePolicy.ANY_RESOURCE,
  }),
})

const secureString = getParameter.getResponseField('Parameter.Value')