Hi, I'm trying to use SSM encrypted parameter for one of my secrets that is used in a (cron) Lambda, but when my function attempts to access it using the SDK, it says my Lambda doesn't have permission to access it. Are there any examples of how to give the permission in my infrastructure stack? I'm trying to use option 3 here: https://docs.serverless-stack.com/environment-variables#3-fetch-ssm-values-in-lambda-using-the-aws-sdk

you can add a policy statement

OK, thanks. And do I do anything with the policy statement once it's defined?

We tend to import like:

const someParam = StringParameter.fromSecureStringParameterAttributes(this, 'someParameter', {
      parameterName: '/my/param/path,
      encryptionKey,
    });

and then use

someParam.grantRead(myLambdaFunction);

@Ross Coundon doesn't that implement option 2 in the link I shared above? I'm trying to read the param within my Lambda function and not have it be decrypted in the infrastructure stack. Or does this just make a wrapper around the parameter for the purpose of adding a read policy?

No - this just grants the permission for the lambda to retrieve the value at runtime

Ross's suggestion is better

Thank you both!