How to reference a plaintext SSM Parameter Store value in CloudFormation?

Understanding Dynamic References in CloudFormation

AWS CloudFormation provides dynamic references to allow templates to include external values without hardcoding them. There are two primary dynamic reference patterns for AWS Systems Manager Parameter Store:

• {{resolve:ssm:parameter-name:version}} — used for plaintext parameters (type String or StringList).
• {{resolve:ssm-secure:parameter-name:version}} — used exclusively for SecureString parameters.

Why Option A is Correct

The question explicitly states that the RDS hostname is stored in Parameter Store as a plaintext value. Therefore, the correct approach is to use the ssm dynamic reference pattern. This pattern retrieves the value at stack creation time and injects it into the template without exposing it in the template body.

Why the Other Options are Incorrect

• Option B (Ref intrinsic function): The Ref function is used to reference parameters declared within the same CloudFormation template or to get the physical ID of a resource created by the stack. It cannot directly retrieve values from Parameter Store unless the parameter is explicitly declared in the template with Type: AWS::SSM::Parameter::Value<String> (which is a different mechanism, not what the question asks).
• Option C (Fn::ImportValue): This function retrieves values that were exported from another CloudFormation stack. The question does not mention any cross-stack exports, making this option irrelevant.
• Option D (ssm-secure dynamic reference): This pattern is strictly for SecureString parameters. Since the question specifies the value is plaintext, using ssm-secure would result in an error.

Community Consensus

The community overwhelmingly supports Option A (91% of votes). As user DeaconStJohn noted, "As it is the DB hostname and not sensitive credentials I think ssm dynamic is the correct answer. Option D is for secure string whereas this parameter is currently stored in plain text." User preachr also confirmed: "To reference a plaintext value stored in Parameter Store in your template, you use the ssm dynamic reference pattern."