CHEF Scipt with embedded BASH/SED command: unexpected `}' - bash

Question

Trying to execute SED against a file from chef is yielding an error, that I am having trouble tracking down
It runs without issue from the console:
sed -i.bak -e "\$aolcRootPW: {SSHA}Z/+CHVP/Vx3bA2m6l0aI6uvIMhJUitpT" /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}bdb.ldif
However from my recipe:
bash 'UPDATE /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}bdb.ldif #3' do
code <<-EOH
sed -i.bak -e "\$aolcRootPW: {SSHA}Z/+CHVP/Vx3bA2m6l0aI6uvIMhJUitpT" /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}bdb.ldif
EOH
end
I am getting the following error
================================================================================
Error executing action `run` on resource 'bash[UPDATE /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}bdb.ldif #3]'
================================================================================
Mixlib::ShellOut::ShellCommandFailed
------------------------------------
Expected process to exit with [0], but received '1'
---- Begin output of "bash" "/tmp/chef-script20151029-7070-y3iz58" ----
STDOUT:
STDERR: sed: -e expression #1, char 8: unexpected `}'
---- End output of "bash" "/tmp/chef-script20151029-7070-y3iz58" ----
Ran "bash" "/tmp/chef-script20151029-7070-y3iz58" returned 1
Resource Declaration:
---------------------
# In /var/chef/cache/cookbooks/3rd-open-ldap-server/recipes/default.rb
64: bash 'UPDATE /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}bdb.ldif #3' do
65: code <<-EOH
66: sed -i.bak -e "\$aolcRootPW: {SSHA}Z/+CHVP/Vx3bA2m6l0aI6uvIMhJUitpT" /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}bdb.ldif
67: EOH
68: end
69: bash 'UPDATE /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}bdb.ldif #4' do
Compiled Resource:
------------------
# Declared in /var/chef/cache/cookbooks/3rd-open-ldap-server/recipes/default.rb:64:in `from_file'
bash("UPDATE /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}bdb.ldif #3") do
action [:run]
retries 0
retry_delay 2
default_guard_interpreter :default
command "UPDATE /etc/openldap/slapd.d/cn\\=config/olcDatabase\\=\\{2\\}bdb.ldif #3"
backup 5
returns 0
code " sed -i.bak -e \"$aolcRootPW: {SSHA}Z/+CHVP/Vx3bA2m6l0aI6uvIMhJUitpT\" /etc/openldap/slapd.d/cn=config/olcDatabase={2}bdb.ldif\n"
interpreter "bash"
declared_type :bash
cookbook_name "3rd-open-ldap-server"
recipe_name "default"
end
Confusingly I don't know what character 8 is. I suspect that it is some sort of escaping issue - but I have no idea where.
Update (to provide insight to where it is not): I think it is in the sed command and not the file name as this command works without issue from chef:
bash 'UPDATE /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}bdb.ldif #2' do
code <<-EOH
sudo sed -i.bak s/dc=my-domain,dc=com/dc=my,dc=lan/g /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}bdb.ldif
EOH
end

Answer 1

I suspect the problem is that there is some environment being set up when you wrap the command where the $a... is getting some bogus shell var substitution done on it. What if you just use single quotes and ditch the \ to try to prevent any such thing?
I.e.:
bash 'UPDATE /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}bdb.ldif #3' do
code <<-EOH
sed -i.bak -e '$aolcRootPW: {SSHA}Z/+CHVP/Vx3bA2m6l0aI6uvIMhJUitpT' /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}bdb.ldif
EOH
end

Answer 2

I needed to double escape the $ at the start of the sed expression:
bash 'UPDATE /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}bdb.ldif #3' do
code <<-EOH
sed -i.bak -e "\\$aolcRootPW: {SSHA}Z/+CHVP/Vx3bA2m6l0aI6uvIMhJUitpT" /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}bdb.ldif
EOH
end