Managing Configuration and Secrets with AWS Systems Manager Parameter Store - Hierarchical Structure and Encryption
This article explains how to manage configuration values and secrets with Parameter Store, how to design the hierarchical structure, and how to choose between Parameter Store and Secrets Manager.
Overview of Parameter Store
Parameter Store is a key-value store that manages configuration data and secrets hierarchically. Whereas Secrets Manager provides features such as automatic rotation of credentials, Parameter Store manages both general application settings (feature flags, endpoint URLs, thresholds) and secrets. Standard parameters are free, and you can create up to 10,000 of them.
Hierarchical Structure and Choosing Between Parameter Store and Secrets Manager
You build a hierarchical structure by using path separators (/) in parameter names. You organize parameters by environment and component, as in /myapp/prod/db/host and /myapp/prod/db/password, and retrieve the parameters under a specific path in bulk with GetParametersByPath. As for choosing between the two, choosing Secrets Manager is a good fit for DB credentials that need automatic rotation, and choosing Parameter Store is a good fit for other configuration values and secrets. Parameter Store also supports references to Secrets Manager (aws:secretsmanager:) and lets you use both services in an integrated way.
Integration with Lambda and ECS
To retrieve Parameter Store parameters from a Lambda function, you use the AWS Parameters and Secrets Lambda Extension. The extension caches parameters locally, so the API calls made on each Lambda execution decrease. You reference Parameter Store parameters in the secrets section of an ECS task definition and inject them as container environment variables. SecureString parameters are encrypted with KMS, and decryption permissions are controlled with IAM policies. Parameter versioning tracks the change history, and you can roll back to a previous version when a problem occurs. Parameter policies set expiration dates and send automatic notifications about expired parameters.
Parameter Store Pricing
Standard parameters are free, and you can store up to 10,000 parameters per account and Region. Advanced parameters cost about $0.05 per parameter per month and support a size of up to 8KB, parameter policies, and a limit of 100,000 parameters (as of August 2026). API calls cost about $0.05 per 10,000 requests with the high-throughput setting (a setting separate from parameter tiers). Compared with Secrets Manager ($0.40 per secret per month), Parameter Store makes it easier to keep costs down for configuration values that do not need automatic rotation.
IAM and Path-Based Access Control
You design Parameter Store permissions by making use of the hierarchy of parameter names. If you restrict the path in the resource specification of an IAM policy, as in /myapp/prod/*, you can control access so that only production roles can access production parameters. Decrypting a SecureString requires, separately from the permission to retrieve the parameter, the permission to decrypt with the KMS key used for encryption. Using a dedicated KMS key for each application and applying least privilege in both key policies and IAM policies leads to a lower risk of secrets being read unintentionally.
Operating Configuration Changes Safely
Each time a parameter is updated, a version number is assigned automatically, and you can refer to past values or revert to a previous version. If you set up your operations so that changes to production settings are applied from a CI/CD pipeline after code review, you can reduce accidents caused by manual work. Because parameter changes can be detected as EventBridge events, you can build a mechanism that sends notifications or automatically starts related processing when a specific setting is rewritten. There is also a method of referencing important settings with an explicit version number so that values do not switch at unintended times.
Retrieval Patterns from Applications and Pitfalls
When an application retrieves parameters frequently, you need to be careful about API throttling. You keep the number of API calls down with measures such as loading parameters only once at startup and caching them in memory, and retrieving multiple parameters together with GetParameters. In CloudFormation and CDK, you can reference parameters dynamically in templates and embed the latest configuration values at deployment time. However, you take care in handling the places where they are referenced so that SecureString values are not expanded into template outputs or logs. When the access frequency is high, you consider the high-throughput setting (a setting separate from parameter tiers).
Sharing Across Multiple Accounts / Multiple Regions
When you use the same settings across multiple accounts or multiple Regions, Parameter Store is independent for each Region, so you design either to place the same parameters in each Region or to read them from a shared account. When you want to distribute common settings across the whole organization, preparing a mechanism that synchronizes them to each environment with CI/CD makes drift, where settings diverge between environments, less likely to occur. Because Advanced parameters have a large size limit per parameter, there is also a method of managing small JSON settings together in a single parameter. If values become too large, you consider splitting the settings or using S3 alongside.
Summary
Parameter Store is a service that manages application settings and secrets hierarchically. The Lambda extension's cache speeds up retrieval of settings, and you can pass them to containers through the secrets section of an ECS task definition. Standard parameters are free, and you can store up to 10,000 of them; compared with Secrets Manager, they make it easier to keep costs down for configuration values that do not need automatic rotation.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
If this page and the official documentation disagree, treat the official documentation as authoritative.