AWS SSM Parameter Store — Short Notes

What is SSM Parameter Store?

• AWS service used to store configuration data and secrets securely.
• Examples: DB URLs, API keys, Passwords, Environment variables
• Part of AWS Systems Manager (SSM).

Why do we use it? (Purpose)

• To avoid hardcoding sensitive data in code.
• To centralize configuration management.
• To securely store secrets with IAM + KMS encryption.
• To support multi-environment applications (Dev / Prod).
• To make applications more secure and scalable.

Key Features

• Secure storage for configs and secrets.
• Encryption using AWS KMS (SecureString).
• IAM-based access control.
• Version tracking of parameters.
• Hierarchical organization of parameters.
• Integration with: Lambda, EC2, ECS,CloudFormation, Notifications via EventBridge.

Types of Parameters

1. String (Plain Text)

• Used for normal configuration data.
• Example: API URL, DB endpoint.

2. SecureString (Encrypted)

• Encrypted using AWS KMS.
• Used for sensitive data.
• Example: passwords, API secrets.

3. StringList

• Stores multiple values in list format.

How it works (Architecture / Flow)

1. Application (EC2 / Lambda) requests parameter.
2. IAM checks permission.
3. Parameter Store returns value: Plain text OR Decrypted using KMS
4. Application uses the config securely.

How to Use (Basic Steps)

1. Create parameter in SSM:

• Name (path-based)
• Value
• Type (String / SecureString)

1. Assign IAM permissions to application.
2. Allow KMS decrypt permission (if SecureString).
3. Access parameter using AWS SDK / CLI.

Hierarchical Structure (Very Important)

• Parameters are stored in structured paths.
• Example:

/my-app/dev/db-url
/my-app/dev/db-password
/my-app/prod/db-url

Benefits:

• Easy organization
• Environment separation (Dev/Prod)
• Easier IAM access control

Parameter Store Tiers

Standard Tier

• Free
• 4 KB size limit
• No parameter policies

Advanced Tier

• Paid
• 8 KB size limit
• Supports parameter policies

Parameter Policies (Advanced Feature)

Used for lifecycle management.

Types:

• Expiration (TTL)
• Expiration notification
• No-change alert

Use Case:

• Alert if password not updated in 30 days
• Auto-expire secrets for security compliance

Integration with KMS

• SecureString uses KMS encryption/decryption
• IAM must allow:
• ssm:GetParameter
• kms:Decrypt

Integration with EventBridge

• Sends alerts for:
• Parameter expiration
• Policy triggers
• No update events

Real-World Use Cases

• Store DB credentials securely
• Manage environment variables
• Centralized configuration for microservices
• Secure CI/CD pipeline configuration
• Replace hardcoded secrets in code

Advantages

• Secure (IAM + KMS)
• Simple and serverless
• Cost-effective (free tier available)
• Easy integration with AWS services
• Supports structured configuration management

Key Points

• SSM Parameter Store = secure config + secret storage service
• Avoids hardcoding secrets in applications
• SecureString uses KMS encryption
• Supports hierarchical parameter structure
• Advanced tier supports TTL + policies
• Better for configuration; Secrets Manager is more advanced for secret rotation
• Integrated with IAM, EventBridge, CloudFormation