AWS Systems Manager Parameter Store

String

Use this type for plain text values, such as environment names, endpoint URLs, or resource identifiers.

StringList

Use this type for a comma-separated list of plain-text values. For example, you could store the value subnet-123abc,subnet-456def,subnet-789ghi.

SecureString

Use SecureString for configuration values that require encryption, such as service endpoints and account identifiers. For secrets such as database credentials, API keys, or tokens, we recommend AWS Secrets Manager, which provides purpose built security controls including automatic rotation and cross-region replication.

Parameter Store encrypts the values using AWS Key Management Service.

Centralized configuration updates

Update your configuration without code changes or redeployments, improving operational agility and reducing risk. For example, you can update /myapp/prod/inventory-service-endpoint to point to a new endpoint after migrating the inventory service.

High-performance throughput option

Parameter Store provides a default throughput suitable for lower-scale workloads. For large or latency-sensitive applications that need higher request rates, you can enable high-throughput mode for an additional cost.

If your application retrieves parameters frequently or at scale, evaluate throughput settings early to avoid throttling. For information about enabling high throughput, see Managing Parameter Store throughput.

Hierarchical parameter management

Use parameter hierarchies to group related parameters, making it easier to discover, manage, and filter them across environments and applications. For example, you can create the naming convention /env/computer-type/app/data, and then create application-specific parameters such as /dev/webserver/linux/approved-ami and /dev/webserver/windows/approved-ami. You can retrieve the path /dev/webserver to find all web server parameters for development environments, or /dev/webserver/linux to find only Linux image parameters.

Versioning

Parameter Store retains the 100 most recent versions of each parameter. When you investigate operational issues, you can review and reconstruct previous values.

Integration with IAM

Use IAM policies to determine whether an application can read, write, list, or delete parameters. For example, you could write an application role that can read parameters prefixed with /myapp/prod/* but not /myapp/dev/*. You could also grant a role permission to decrypt an encrypted parameter.

Accessibility from other AWS services

You can reference parameter values from other AWS services. Here are some examples:

Shared account access

Centralize configuration data in a single AWS account and share parameters with other accounts that need access. For more information, see Working with shared parameters in Parameter Store.

OS patching

Amazon EC2 lets you specify the operating system for new instances by referencing a parameter instead of hardcoding an AMI (AMI) ID. This approach ensures your instances automatically use the latest patched and updated images. AWS and operating system vendors provide public parameters that track current AMI versions, so you don't have to manage updates manually. You can also define your own parameters to reference a centrally managed golden AMI, making it easier to enforce consistent, approved configurations across your organization.

Events and notifications

Automate workflows in Parameter Store by subscribing to parameter change events. You can also use change events to enforce expiration and receive notifications when a parameter hasn't been rotated within a specified timeframe.