# Amazon Systems Manager Parameter Store
<a name="systems-manager-parameter-store"></a>

Parameter Store is a centralized configuration data store for named values called parameters. A *parameter* is any piece of data stored in Parameter Store, such as a block of text, a list of names, an AMI ID, a license key, and so on. With Parameter Store, you can securely store, organize, and retrieve configuration data at scale.

Parameter Store simplifies configuration management across environments. You can standardize how applications access critical data at runtime without hardcoding values or relying on fragmented storage solutions. In this way, you maintain consistency, enforce governance, and build more secure and maintainable systems. 

Parameter Store supports the following parameter types:
+ `String`

  Use this type for plain text values, such as environment names, endpoint URLs, or resource identifiers.
+ `StringList`

  Use this type for a comma-separated list of plain-text values. For example, you could store the value `subnet-123abc,subnet-456def,subnet-789ghi`.
+ `SecureString`

  Use `SecureString` for configuration values that require encryption, such as service endpoints and account identifiers. For secrets such as database credentials, API keys, or tokens, we recommend Amazon Secrets Manager, which provides purpose built security controls including automatic rotation and cross-region replication.

  Parameter Store encrypts the values using Amazon Key Management Service.

For more information about parameter types, see [Parameter Store reference](what-is-a-parameter.md).

## Where should I store my application data?
<a name="parameter-store-use-cases"></a>

Use the following table to choose a service for your application data.

**Note**  
If you manage credentials such as usernames, passwords, or any other secrets, we recommend using [Amazon Secrets Manager](https://docs.amazonaws.cn/secretsmanager/latest/userguide/intro.html). Secrets Manager is purpose-built for managing secrets such as database credentials, API keys, and supported third-party software-vended secrets. For more information, see [What is Amazon Secrets Manager?](https://docs.amazonaws.cn/secretsmanager/latest/userguide/intro.html) in the *Amazon Secrets Manager User Guide*.



| Feature | Parameter Store | Amazon AppConfig | Amazon Secrets Manager | 
| --- | --- | --- | --- | 
| Use cases |  +  Static configuration <br />+  Key-value storage without deployment, with optional validation by data type. For more information, see [Parameter data types in Parameter Store](parameter-store-data-types.md).   |  +  Frequently changed application configuration <br />+  Zero-downtime deployments <br />+  Runtime experiments   |  +  Credentials or any other secrets <br />+  Encrypted data requiring automatic rotation, cross-account access, or fine-grained audit logging   | 
| Typical data |  +  Approved AMI IDs <br />+  Environment variables <br />+  Endpoint URLs <br />+  Resource identifiers <br />+  Tuning parameters   |  +  Feature flags <br />+  Operational toggles <br />+  Tunable parameters <br />+  Allow and deny lists   |  +  Database credentials <br />+  API keys <br />+  OAuth tokens <br />+  Private keys and certificates   | 
| Encryption | Optional with `SecureString` and Amazon KMS | Amazon managed encryption at rest; optional additional customer managed key | Amazon KMS encryption at rest with an Amazon managed or customer managed key | 
| Credential rotation | None | Not applicable | Automatic, with native database integrations | 
| Cost | Standard tier free; advanced tier and higher throughput billed | Billed per configuration request | Billed per secret per month and per API call | 
| Deployment | Versioning and value validation by data type, without gradual rollout or automatic rollback | Gradual rollout, pre-deployment validation, and automatic rollback on Amazon CloudWatch alarms | Versioning with staging labels | 

## Parameter Store features
<a name="parameter-store-features"></a>

Parameter Store supports the following features:
+ **Centralized configuration updates**

  Update your configuration without code changes or redeployments, improving operational agility and reducing risk. For example, you can update /myapp/prod/inventory-service-endpoint to point to a new endpoint after migrating the inventory service.
**Note**  
A parameter update takes effect on the next read. Parameter Store doesn't roll out the update gradually or revert it automatically, and it validates the new value only against the parameter's data type and any allowed pattern. For more information about data types, see [Parameter data types in Parameter Store](parameter-store-data-types.md).  
For configuration where a bad value could cause an outage, Amazon AppConfig adds a managed deployment workflow. It validates the change (using JSON Schema or Lambda), rolls it out gradually, and monitors your Amazon CloudWatch alarms. If an alarm goes into the `ALARM` state, Amazon AppConfig automatically rolls back the change (this requires the necessary IAM permissions). See [Working with deployment strategies](https://docs.amazonaws.cn/appconfig/latest/userguide/appconfig-creating-deployment-strategy.html).
+ **High-performance throughput option**

  Parameter Store provides a default throughput suitable for lower-scale workloads. For large or latency-sensitive applications that need higher request rates, you can enable high-throughput mode for an additional cost.

  If your application retrieves parameters frequently or at scale, evaluate throughput settings early to avoid throttling. For information about enabling high throughput, see [Managing Parameter Store throughput](parameter-store-throughput.md).
+ **Hierarchical parameter management**

  Use [parameter hierarchies](https://docs.amazonaws.cn/systems-manager/latest/userguide/sysman-paramstore-hierarchies.html) to group related parameters, making it easier to discover, manage, and filter them across environments and applications. For example, you can create the naming convention /env/computer-type/app/data, and then create application-specific parameters such as /dev/webserver/linux/approved-ami and /dev/webserver/windows/approved-ami. You can retrieve the path /dev/webserver to find all web server parameters for development environments, or /dev/webserver/linux to find only Linux image parameters.
+ **Versioning**

  Parameter Store retains the 100 most recent [versions](https://docs.amazonaws.cn/systems-manager/latest/userguide/sysman-paramstore-versions.html) of each parameter. When you investigate operational issues, you can review and reconstruct previous values.
+ **Integration with IAM**

  Use IAM policies to determine whether an application can read, write, list, or delete parameters. For example, you could write an application role that can read parameters prefixed with /myapp/prod/\* but not /myapp/dev/\*. You could also grant a role permission to decrypt an encrypted parameter.
+ **Accessibility from other Amazon Web Services services**

  You can reference parameter values from other Amazon services. Here are some examples:
  + Lambda functions can retrieve parameters and secrets using the [Parameters and Secrets Lambda Extension](https://docs.amazonaws.cn/systems-manager/latest/userguide/ps-integration-lambda-extensions.html).
  + Amazon Elastic Container Service and Amazon Fargate allow you to [inject environmental variables](https://docs.amazonaws.cn/AmazonECS/latest/developerguide/secrets-envvar-ssm-paramstore.html) whose values are managed centrally in Parameter Store.
**Note**  
Environment variables from Parameter Store are resolved when a task starts. A running task needs a new task or a forced deployment to pick up a changed value. For configuration that should update without replacing tasks, run the Amazon AppConfig Agent as an additional container to serve the latest values to your application. For secrets, use Amazon Secrets Manager. See [What is Amazon AppConfig Agent?](https://docs.amazonaws.cn/appconfig/latest/userguide/appconfig-agent.html)
  + Amazon CloudFormation templates can reference [parameter values](https://docs.amazonaws.cn/AWSCloudFormation/latest/UserGuide/dynamic-references-ssm.html).
  + With Amazon AppConfig, you can create [configuration profiles that reference a parameter](https://docs.amazonaws.cn/appconfig/latest/userguide/appconfig-creating-free-form-configuration-and-profile-create-console.html) in Parameter Store, adding deployment safety (gradual rollout, validation, and automatic rollback on a configured Amazon CloudWatch alarm) while Parameter Store remains your source.
  + Amazon CodeBuild lets you [define environmental variables](https://docs.amazonaws.cn/codebuild/latest/userguide/build-spec-ref.html#build-spec.env.parameter-store) whose values are dynamically retrieved from Parameter Store at build time.
+ **Shared account access**

  Centralize configuration data in a single Amazon Web Services account and share parameters with other accounts that need access. For more information, see [Working with shared parameters in Parameter Store](parameter-store-shared-parameters.md).
+ **OS patching**

  Amazon EC2 lets you specify the operating system for new instances by [referencing a parameter instead of hardcoding an AMI (AMI) ID](https://docs.amazonaws.cn/AWSEC2/latest/UserGuide/using-systems-manager-parameter-to-find-AMI.html). This approach ensures your instances automatically use the latest patched and updated images. Amazon and operating system vendors provide [public parameters](https://docs.amazonaws.cn/systems-manager/latest/userguide/parameter-store-finding-public-parameters.html) that track current AMI versions, so you don't have to manage updates manually. You can also define your own parameters to reference a centrally managed golden AMI, making it easier to enforce consistent, approved configurations across your organization.
+ **Events and notifications**

  Automate workflows in Parameter Store by subscribing to parameter [change events](https://docs.amazonaws.cn/systems-manager/latest/userguide/sysman-paramstore-cwe.html). You can also use [change events](https://docs.amazonaws.cn/systems-manager/latest/userguide/parameter-store-policies.html) to enforce expiration and receive notifications when a parameter hasn't been rotated within a specified timeframe.

## Parameter tiers in Parameter Store
<a name="parameter-store-tiers-introduction"></a>

Parameter Store offers different parameter tiers that control storage limits: the maximum number and size of your parameters in an Amazon account and Region. Configure each parameter individually to use either the standard tier or advanced tier.

You can mix standard and advanced parameters. For example, you can have up to 100,000 advanced parameters and 10,000 standard parameters in the same Amazon account and Region. The following table describes the different features supported for each parameter type.

The following table describes the differences between parameter tiers.



| Feature or use case | Standard | Advanced | 
| --- | --- | --- | 
| Use case | Best for most configuration data and low-scale workloads. This is the default. | Best when you need higher limits, larger values, or parameter policies. | 
| Maximum parameters<br />(per Amazon Web Services account and Amazon Web Services Region) | 10,000 | 100,000 | 
| Maximum value size | 4 KB | 8 KB | 
| Parameter policies | Not supported | Supported<br />For more information, see [Assigning parameter policies in Parameter Store](parameter-store-policies.md). | 
| Shareability across Amazon Web Services accounts | Not supported | Supported<br />For more information, see [Working with shared parameters in Parameter Store](parameter-store-shared-parameters.md). | 
| Data types | All data types except `url`, `json`, and `jsonc` | All data types<br />For more information, see [Parameter data types in Parameter Store](parameter-store-data-types.md). | 
| Upgrade and downgrade capability | Upgradeable | Not downgradeable | 
| Cost | No additional charge | Charges apply<br />For more information, see [Amazon Systems Manager Pricing for Parameter Store](https://www.amazonaws.cn/systems-manager/pricing/#Parameter_Store). | 

Use standard parameters for most configuration data. Use advanced parameters only when you need capabilities that standard parameters don't support.

For a detailed comparison of standard and advanced parameters, see [Choosing parameter tiers](https://docs.amazonaws.cn/systems-manager/latest/userguide/parameter-store-advanced-parameters.html).