Systems Manager Parameter Store
AWS Systems Manager Parameter Store provides secure, hierarchical storage for configuration data. It has a free tier, integrates with most AWS services, and is the usual home for the settings an application needs at start-up.
What it stores
Section titled “What it stores”String— plain textStringList— a comma-separated listSecureString— encrypted with an AWS KMS key
Typical contents: database connection strings, API endpoints, AMI IDs, licence codes, feature flags, and passwords where rotation is handled elsewhere.
Parameter names are hierarchical paths — /myapp/prod/db/host — and GetParametersByPath
retrieves a whole branch in one call. IAM policies can be written against a path prefix,
which is what makes per-environment separation straightforward.
Every change creates a new numbered version, and previous versions remain retrievable.
The tier controls storage attributes: how many parameters, how large a value, and whether parameter policies are available. Each parameter has its own tier, set when it is created or updated, and configured per AWS account and Region.
| Standard | Advanced | |
|---|---|---|
| Maximum parameters per account and Region | 10,000 | 100,000 |
| Maximum value size | 4 KB | 8 KB |
| Parameter policies | Not supported | Supported |
| Cross-account sharing | Not supported | Supported |
| Cost | No additional charge | Charged per parameter |
Parameter policies, available only in the advanced tier, attach an expiry date to a parameter, send a notification before it expires, or notify when a parameter has not changed for a given period — useful for credentials that a person is expected to rotate.
A standard parameter can be upgraded to advanced at any time. An advanced parameter cannot be downgraded, because doing so would truncate the value from 8 KB to 4 KB, drop any attached policies, and change the form of encryption. To go back, delete the parameter and recreate it as a standard one.
The account-level default tier setting is separate from an individual parameter’s tier: it
only decides what a new parameter gets when no tier is specified, and changing it does not
affect existing parameters. It can also be set to Intelligent-Tiering, which picks the
standard tier unless the parameter needs an advanced-tier feature.
Throughput
Section titled “Throughput”Throughput is not a tier property. It is a separate account and Region setting that controls the request rate.
- By default, 40 transactions per second, shared across
GetParameter,GetParametersandGetParametersByPath. - With higher throughput enabled, the limits rise substantially — into the thousands of
transactions per second for
GetParameter. Higher throughput is charged per API interaction.
Applications should cache retrieved values rather than call Parameter Store on every request. The AWS Parameters and Secrets Lambda extension and the Systems Manager Agent both provide a local cache.
What it does not do
Section titled “What it does not do”Parameter Store does not rotate anything, in either tier. Automatic rotation of credentials is an AWS Secrets Manager feature. A parameter policy can notify that a value is stale, but nothing in Parameter Store will replace it. If a credential must be rotated automatically, it belongs in Secrets Manager — see Secrets Manager vs Parameter Store for the full comparison.