CloudFormation作成時に、動的な外部パラメータを利用する方法(Secrets Manager)

#S3バケット作成
# --------------------------------------------------------
# パラメータ定義
# -------------------------------------------------------
Parameters:
  #拠点名を入力
  placeName:
    Description: input_place_name
    Type: String

Resources:
  # ----------------------------------
  # S3バケット  拠点名で作成
  # ----------------------------------
  S3Bucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      #バケット名は拠点名
      BucketName: !Sub '${placeName}'
      #アクセス制限（バケット作成時のデフォルト）
      AccessControl: Private
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

Outputs:
  S3BucketName:
    Value: !Sub '${placeName}'

aws cloudformation create-stack \
 --stack-name hogehoge  \
 --capabilities CAPABILITY_IAM  \
 --template-body file:///home/centos/hogehoge/hoge.yml
 --parameters ParameterKey=placeName,ParameterValue=hoge   

# --------------------------------------------------------
# パラメータ定義
# -------------------------------------------------------
Parameters:
  #拠点名
  placename:
    Description: input_place_name
    Type: String
  #Secrets Managerの名前（拠点のIPアドレス一覧）
  secretName:
    Type: String
    Default: ipaddress-place
    AllowedValues : ["ipaddress-place"]
  #バージョン番号(変えないとSecrets Managerを再取得しません)
  version:
    Type: String
    Description: input_version_on_change
    Default: 0

Resources:
  # --------------------------------------------------------
  # Secrets Managerの値を見るためにラムダ関数を作成
  # -------------------------------------------------------
  CustomResource:
    Type: Custom::PythonLambdaExecution
    Properties:
      ServiceToken: !GetAtt CustomFunction.Arn
      Version: !Ref version
  CustomFunction:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        ZipFile: !Sub |
          import cfnresponse
          import boto3
          import json

          def handler(event, context):
            if event['RequestType'] == "Create" or event['RequestType'] == "Update":

              client = boto3.client('secretsmanager')
              secret_str = client.get_secret_value(SecretId='${secretName}')['SecretString']
              data = json.loads(secret_str)
              result = {
                'value' : data['ipaddress-${placename}']
              }
              cfnresponse.send(event, context, cfnresponse.SUCCESS, result)
            if event['RequestType'] == "Delete":
              cfnresponse.send(event, context, cfnresponse.SUCCESS, {})
      Handler: index.handler
      Runtime: python3.6
      Timeout: 30
      Role: !GetAtt LambdaExecutionRole.Arn
  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
              - lambda.amazonaws.com
            Action:
            - sts:AssumeRole
      Path: "/"
      Policies:
        - PolicyName: custom_resource_policy_secretsmanager
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: arn:aws:logs:*:*:*
              - Effect: Allow
                Action:
                  - secretsmanager:GetSecretValue
                Resource: '*'
  # ----------------------------------
  # IAMグループ（ポリシーをインライン定義）
  # ----------------------------------
  IAMGROUP:
    Type: 'AWS::IAM::Group'
    Properties:
      #グループ名 group-拠点名
      GroupName: !Sub 'group-${placename}'
      Policies:
        #ポリシー名 group-拠点名
        - PolicyName: !Sub 'group-${placename}'
          PolicyDocument:
            Statement:
              - Effect: Allow
                #利用可能権限
                Action:
                  - 's3:ListBucket'
                  - 's3:GetBucketLocation'
                  - 's3:PutObject'
                  - 's3:GetObject'
                  - 's3:DeleteObject'
                #特定のバケット名のみ参照可能とする
                Resource: 
                  - !Sub 'arn:aws:s3:::${placename}*'
                  - !Sub 'arn:aws:s3:::${placename}*/*'
                #特定のIPアドレスのみ参照可能とする。
                #Lambda関数を利用して、Secrets Managerの値を取得
                Condition:
                  IpAddress:
                    aws:SourceIp: !Split
                      - ','
                      - !GetAtt CustomResource.value

          def handler(event, context):
            if event['RequestType'] == "Create" or event['RequestType'] == "Update":

              client = boto3.client('secretsmanager')
              secret_str = client.get_secret_value(SecretId='${secretName}')['SecretString']
              data = json.loads(secret_str)
              result = {
                'value' : data['ipaddress-${placename}']
              }
 

  # ----------------------------------
  # IAMグループ（ポリシーをインライン定義）
  # ----------------------------------
  IAMGROUP:
    Type: 'AWS::IAM::Group'
    Properties:
      #グループ名 group-拠点名
      GroupName: !Sub 'group-${placename}'
      Policies:
        #ポリシー名 group-拠点名
        - PolicyName: !Sub 'group-${placename}'
          PolicyDocument:
            Statement:
              - Effect: Allow
                #利用可能権限
                Action:
                  - 's3:ListBucket'
                  - 's3:GetBucketLocation'
                  - 's3:PutObject'
                  - 's3:GetObject'
                  - 's3:DeleteObject'
                #特定のバケット名のみ参照可能とする
                Resource: 
                  - !Sub 'arn:aws:s3:::${placename}*'
                  - !Sub 'arn:aws:s3:::${placename}*/*'
                #特定のIPアドレスのみ参照可能とする。
                #Lambda関数を利用して、Secrets Managerの値を取得
                Condition:
                  IpAddress:
                    aws:SourceIp: !Split
                      - ','
                      - !GetAtt CustomResource.value