Study guide
Technical reference and lesson notes
Purpose of This Lesson
AWS Systems Manager Parameter Store provides a centralized, hierarchical repository for application configuration values and sensitive data. It is commonly used by workloads such as Amazon EC2 applications that need database connection details, passwords, license codes, or other runtime settings without embedding them directly in application code.
The key architectural decision is whether Parameter Store is sufficient for the use case or whether AWS Secrets Manager is more appropriate, particularly when automatic secret rotation is required.
Key Concepts
Centralized parameter storage
Parameter Store stores values as named parameters. Applications retrieve a parameter by using the parameter name rather than hardcoding the value in source code or configuration files deployed with the application.
Typical values include:
- Database passwords
- Database connection strings
- Application settings
- License codes
- Other environment-specific configuration data
Hierarchical parameter names
Parameters can be organized using path-like names. A hierarchy helps separate applications, environments, or configuration domains.
Example naming patterns:
/app-name/dev/database/connection-string
/app-name/prod/database/connection-string
/app-name/prod/database/password
Application code can reference the appropriate parameter path for its environment, allowing the stored value to change without requiring the code itself to change.
Plaintext and encrypted values
Parameter values can be stored as either:
- Plaintext: Suitable for non-sensitive configuration data.
- Encrypted ciphertext: Suitable for sensitive values such as passwords and connection strings.
Sensitive values should be stored using the encrypted option rather than plaintext. The consuming workload must have the required permissions to retrieve the parameter and, where applicable, decrypt its value.
Application integration pattern
A common pattern uses an Amazon EC2 application and an Amazon RDS database:
- Store the RDS connection information and password in Parameter Store.
- Grant the EC2 workload permission to retrieve the required parameter values.
- Have the application request the values at runtime.
- Use the retrieved values to connect to RDS.
This separates secrets and configuration from application source code and makes environment-specific values easier to manage.
Rotation limitation
Parameter Store does not provide native automatic secret rotation. If a password must be changed regularly, an external process—such as an AWS Lambda function or another operational workflow—must update the parameter and coordinate the change with the dependent system.
AWS Secrets Manager is generally the better fit when built-in secret rotation is a core requirement.
Exam-Relevant Takeaways
- Parameter Store is a centralized store for configuration data and secrets.
- Parameters are addressed by unique names.
- Hierarchical paths help organize values by application, environment, or purpose.
- Values may be stored as plaintext or encrypted ciphertext.
- Do not place passwords or connection strings directly in application code when a managed parameter store can be used.
- Parameter Store does not natively rotate secrets. Choose Secrets Manager when automatic rotation is required, or design an external rotation process.
- The workload needs permission to retrieve the parameter. Encryption does not eliminate the need for appropriate access control.
Architecture Decision Guide
| Requirement | Recommended approach | Reason |
|---|---|---|
| Store non-sensitive application settings centrally | Parameter Store with plaintext values | Provides named, hierarchical configuration storage |
| Store a password or connection string outside application code | Parameter Store with encrypted values | Keeps sensitive values separate from source code and deployment artifacts |
| Separate values for development and production | Use hierarchical parameter paths | Paths provide clear environment and application organization |
| Automatically rotate database credentials | AWS Secrets Manager | Parameter Store has no native automatic rotation |
| Rotate a Parameter Store value using a custom workflow | Parameter Store plus an external process such as Lambda | Rotation must be implemented and operated outside Parameter Store |
| Allow an EC2 application to consume configuration | Attach suitable permissions to the EC2 workload and retrieve parameters at runtime | Avoids embedding values in the application |
Common Exam Traps
- Assuming Parameter Store automatically rotates secrets: It does not. Native rotation is a key distinction in favor of Secrets Manager.
- Treating all parameters as encrypted by default: Parameter Store supports plaintext and encrypted values. Sensitive data should be explicitly handled as encrypted data.
- Hardcoding a parameter value after initially centralizing it: The application should retrieve the current value by name rather than copying the secret back into source code.
- Ignoring workload permissions: An EC2 instance cannot retrieve a parameter merely because the parameter exists. Its identity must be authorized to access it.
- Confusing hierarchical organization with a database relationship: Parameter paths organize names; they do not create relational links between parameters or systems.
- Choosing Parameter Store when the requirement explicitly calls for managed automatic rotation: That requirement points toward Secrets Manager.
Real-World Engineer Notes
- Use consistent parameter naming conventions across applications and environments. A predictable hierarchy simplifies deployments and troubleshooting.
- Keep production and non-production values in clearly separated paths.
- Grant workloads access only to the parameters they need rather than broad access to an entire parameter namespace.
- Prefer runtime retrieval or a controlled configuration-loading process over committing credentials to source control.
- If implementing custom rotation with Lambda, plan the complete workflow: update the credential in the target system, update the stored parameter, and ensure applications can safely consume the new value.
- Evaluate whether the application should retrieve values at startup or periodically. Runtime retrieval can reduce redeployment requirements, while caching may reduce repeated calls and limit operational dependencies.
Quick Reference Summary
- Service: AWS Systems Manager Parameter Store
- Primary purpose: Store configuration values and secrets centrally
- Organization: Hierarchical parameter names and paths
- Value formats: Plaintext or encrypted ciphertext
- Typical consumers: Amazon EC2 applications and other AWS workloads
- Access pattern: Application retrieves values by parameter name
- Automatic rotation: Not provided natively
- Rotation alternative: External automation, such as AWS Lambda
- Primary alternative: AWS Secrets Manager when managed rotation is required
Flashcards
1. What is AWS Systems Manager Parameter Store used for?
Centralized storage of application configuration data and secrets such as passwords, connection strings, and license codes.
2. How does an application identify a parameter?
By using the unique parameter name assigned when the parameter is created.
3. What does hierarchical storage mean in Parameter Store?
Parameter names can use path-like structures to organize values by application, environment, or purpose.
4. Can Parameter Store store unencrypted values?
Yes. It supports plaintext values for non-sensitive configuration data.
5. How should sensitive values be stored?
As encrypted values rather than plaintext.
6. Why store a database password in Parameter Store instead of application code?
It separates the secret from source code and allows the value to be managed independently of application deployments.
7. Does Parameter Store automatically rotate secrets?
No. Automatic rotation is not provided natively.
8. What service is typically preferred when automatic secret rotation is required?
AWS Secrets Manager.
9. How can Parameter Store values be rotated if Parameter Store is still used?
An external workflow, such as AWS Lambda automation, must update the value and coordinate the change with the target system.
10. What must an EC2 application have before it can retrieve a parameter?
Appropriate permissions to access the parameter and, for encrypted values, to decrypt it as required.
Practice Questions
Question 1
A company runs a web application on Amazon EC2 that connects to an Amazon RDS database. The security team prohibits database passwords from being stored in source code. The application must retrieve the password from a centralized AWS service, but automatic rotation is not required. Which solution best meets the requirements?
Correct answer: Store the password as an encrypted parameter in AWS Systems Manager Parameter Store and grant the EC2 workload permission to retrieve it.
Explanation: Parameter Store provides centralized storage for encrypted configuration values and secrets. The application can retrieve the password by parameter name without embedding it in source code. Since automatic rotation is not required, Secrets Manager is not necessary based on the stated requirements.
Question 2
A solutions architect is designing a platform with separate database connection strings for development, test, and production. The architect wants applications to retrieve the correct value using a consistent naming scheme. Which Parameter Store feature should be used?
Correct answer: Hierarchical parameter names using environment-specific paths.
Explanation: Path-like names can organize parameters by application and environment, such as /orders/dev/database/connection-string and /orders/prod/database/connection-string.
Question 3
A company requires database credentials to rotate automatically on a fixed schedule. The credentials must be updated in both the database and the secret repository without custom rotation code. Which service is the most appropriate choice?
Correct answer: AWS Secrets Manager.
Explanation: Parameter Store does not provide native automatic secret rotation. Secrets Manager is designed for secret lifecycle management and is the better choice when managed rotation is an explicit requirement.
Question 4
An EC2 application attempts to read an encrypted parameter from Parameter Store but receives an access-denied error. The parameter exists and is correctly named. What is the most likely cause?
Correct answer: The EC2 workload lacks the required permissions to retrieve the parameter or decrypt its value.
Explanation: Parameter existence does not grant access. The workload identity must be authorized to read the parameter and, for encrypted values, perform the necessary decryption operation.
Question 5
A team stores a database password in Parameter Store. A new policy requires the password to change every 30 days, and applications must continue using the current credential without manual intervention. What must the team add if it continues using Parameter Store?
Correct answer: An external automated rotation workflow, such as AWS Lambda, that updates the database credential and the corresponding Parameter Store value.
Explanation: Parameter Store has no native secret rotation function. Continuing to use it requires custom automation that keeps the target database and stored parameter synchronized.