SSM Parameter Store
Store configuration and secrets as parameters your apps and pipelines read at runtime.
SSM Parameter Store is a free, simple place to keep configuration — URLs, feature flags, and secrets — organized as a hierarchy of named parameters.
Two parameter types
- String — plain config like
/myapp/prod/log-level. - SecureString — encrypted with KMS for sensitive values like database passwords.
Apps read parameters at startup, and ECS/Lambda can inject them directly. Because parameters are namespaced by environment, the same code reads /myapp/staging/* or /myapp/prod/* based on config.
Example
# Store an encrypted secret
aws ssm put-parameter \
--name /myapp/prod/db-url \
--type SecureString \
--value 'postgres://user:[email protected]:5432/app'
# Read it back (decrypted) at deploy or runtime
aws ssm get-parameter --name /myapp/prod/db-url --with-decryption \
--query Parameter.Value --output textWhen to use it
- A deployment script reads the database connection string from SSM Parameter Store so the value never appears in source code or environment files.
- A team uses SSM parameter hierarchy (/prod/app/*, /dev/app/*) so the same app binary reads the correct config for its environment at runtime.
- A CodePipeline build phase reads an API endpoint from SSM so changing the endpoint requires no code change and no rebuild.
More examples
Write a parameter to SSM
Writes a plain config value and an encrypted secret to SSM Parameter Store using the /prod/app/ namespace.
# Store a plain string parameter
aws ssm put-parameter \
--name '/prod/app/api-endpoint' \
--value 'https://api.example.com' \
--type String \
--overwrite
# Store an encrypted secret
aws ssm put-parameter \
--name '/prod/app/db-password' \
--value 'S3cr3tP@ss' \
--type SecureString \
--overwriteRead a parameter in a deploy script
Retrieves and decrypts a SecureString parameter at deploy time and exports it as an environment variable.
DB_PASS=$(aws ssm get-parameter \
--name '/prod/app/db-password' \
--with-decryption \
--query 'Parameter.Value' \
--output text)
export DB_PASSWORD=$DB_PASSRetrieve all params in a path
Fetches all parameters under the /prod/app/ path recursively, useful for auditing or bulk loading config.
aws ssm get-parameters-by-path \
--path '/prod/app/' \
--with-decryption \
--recursive \
--query 'Parameters[*].[Name,Value]' \
--output table
Discussion