Error Code: MalformedPolicyDocument

[afisher-stelligent]

Hello All...

Using the latest Python CDK. I have two applications, one to deploy infrastructure, and another that deploys a CodePipeline.

The infrastructure creates a database, and we generate a secret:

secret = secretsmanager.Secret.from_secret_name_v2(self, "mySecret", database_cluster.secret.secret_name)

The ARN of the secret is an output of the stack.

Now, as part of the pipeline, we're trying to do automated updates using Flyway. This requires pulling the db user and password from the secret above. This is how I'm attempting to do it:

db_secret = sm.Secret.from_secret_complete_arn(self, "my_secret", Fn.import_value("SecretARN"))
db_user = sm.Secret.secret_value_from_json(db_secret, 'username').unsafe_unwrap() # yes I know this isn't the best
db_pass = sm.Secret.secret_value_from_json(db_secret, 'password').unsafe_unwrap()

Then, as part of the pipeline project:

database_migration = codebuild.PipelineProject(self, 'Db_Migration',
...
  environment_variables={
                'FLYWAY_USER': codebuild.BuildEnvironmentVariable(value=db_user, type=codebuild.BuildEnvironmentVariableType.SECRETS_MANAGER),
                'FLYWAY_PASSWORD': codebuild.BuildEnvironmentVariable(value=db_pass, type=codebuild.BuildEnvironmentVariableType.SECRETS_MANAGER)
...

When I try to deploy, I get the following error:
❌ CdkPipielineStack failed: Error: The stack named CdkPipielineStack failed to deploy: UPDATE_ROLLBACK_COMPLETE: Resource <blah> must be in ARN format or "*". (Service: AmazonIdentityManagement; Status Code: 400; Error Code: MalformedPolicyDocument; Request ID: blah; Proxy: null)

The CFN that is synthesized is bad... so the error's not wrong. What am I missing?