Managing Configuration and Secrets with AWS Systems Manager Parameter Store - Hierarchical Structure and Encryption
Learn how to manage configuration values and secrets with Parameter Store, design hierarchical parameter structures, and choose between Parameter Store and Secrets Manager.
Overview of Parameter Store
Parameter Store is a key-value store for managing configuration data and secrets in a hierarchical structure. While Secrets Manager specializes in automatic rotation of database credentials, Parameter Store manages both general application settings (feature flags, endpoint URLs, thresholds) and secrets. Standard parameters are free, with a limit of up to 10,000 per account.
Hierarchical Structure and Choosing Between Secrets Manager
Use path separators (/) in parameter names to build a hierarchical structure. Organize parameters by environment and component, such as /myapp/prod/db/host and /myapp/prod/db/password, and use GetParametersByPath to retrieve all parameters under a specific path at once. For choosing between Secrets Manager and Parameter Store: use Secrets Manager for database credentials that require automatic rotation, and Parameter Store for all other configuration values and secrets. Parameter Store also supports Secrets Manager references (aws:secretsmanager:), allowing you to use both services in an integrated manner.
Integration with Lambda and ECS
To retrieve Parameter Store parameters from Lambda functions, use the AWS Parameters and Secrets Lambda Extension. The extension caches parameters locally, eliminating the need for an API call on every Lambda invocation. In ECS task definitions, reference Parameter Store parameters in the secrets section to inject them as container environment variables. SecureString parameters are encrypted with KMS, and decryption permissions are controlled through IAM policies. Parameter versioning tracks change history, enabling rollback to a previous version when issues arise. Parameter policies allow setting expiration dates and automatic notifications for expired parameters. To deepen your operational knowledge of configuration management, specialized books on Amazon are a useful resource.
Parameter Store Pricing
Standard parameters are free, with a limit of up to 10,000 parameters per account. Advanced parameters cost approximately $0.05 per parameter per month and support sizes up to 8 KB, parameter policies, and a limit of 100,000 parameters. API calls are free for Standard parameters, and approximately $0.05 per 10,000 requests for Advanced parameters with the higher throughput option. Compared to Secrets Manager ($0.40/secret/month), Parameter Store is more cost-effective for configuration values that do not require automatic rotation.
Summary
Parameter Store is a service for managing application settings and secrets in a hierarchical structure. The Lambda extension enables low-latency configuration retrieval through caching, and the ECS task definition secrets section provides secure injection into containers. Standard parameters are free for up to 10,000 entries, offering superior cost efficiency compared to Secrets Manager for configuration values that do not require automatic rotation.