Parameter Store

# ===== What it is =====
# Hierarchical store for configuration values + secrets.
# Free for STANDARD parameters (under 4KB, no rotation).
# Charged for ADVANCED parameters + higher-throughput tiers.
# Encrypted via KMS for SecureString type.

# ===== Compared to Secrets Manager =====
# Parameter Store: free standard, configurable advanced, simple hierarchy
# Secrets Manager: rotation built-in, cross-account, higher cost

# Use Parameter Store for: feature flags, non-rotating config, environment variables
# Use Secrets Manager for: DB credentials with rotation, API keys with rotation

# ===== Hierarchical naming =====
# /shop/prod/db/host
# /shop/prod/db/port
# /shop/prod/api/key
# /shop/dev/db/host

# Hierarchy enables IAM scoping by path prefix.

# ===== Create =====
aws ssm put-parameter \
  --name /shop/prod/db/host \
  --value 'prod-db.cluster-xxx.rds.amazonaws.com' \
  --type String

aws ssm put-parameter \
  --name /shop/prod/api/key \
  --value 'sk_live_...' \
  --type SecureString \
  --key-id alias/shop-key

# ===== Read =====
aws ssm get-parameter --name /shop/prod/db/host
aws ssm get-parameter --name /shop/prod/api/key --with-decryption

# By path:
aws ssm get-parameters-by-path \
  --path /shop/prod \
  --recursive \
  --with-decryption

# ===== Use in code (Node) =====
import { SSMClient, GetParameterCommand } from '@aws-sdk/client-ssm';

const ssm = new SSMClient({});
const r = await ssm.send(new GetParameterCommand({
  Name: '/shop/prod/api/key',
  WithDecryption: true,
}));
console.log(r.Parameter?.Value);

# Boto3 (Python):
import boto3
ssm = boto3.client('ssm')
val = ssm.get_parameter(Name='/shop/prod/api/key', WithDecryption=True)['Parameter']['Value']

# ===== Use in Lambda env via SSM extension =====
# AWS provides a Lambda layer that caches Parameter Store reads via HTTP localhost.
# Reduces cold-start and API call cost.

# ===== Use as environment variables =====
# In ECS task definition:
{
  "name": "DB_HOST",
  "valueFrom": "arn:aws:ssm:ap-southeast-2:123:parameter/shop/prod/db/host"
}

# CodeBuild / CodePipeline: same shape.

# ===== IAM (path-scoped) =====
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath"],
    "Resource": "arn:aws:ssm:ap-southeast-2:123:parameter/shop/prod/*"
  }]
}

# KMS Decrypt permission needed for SecureString:
{
  "Effect": "Allow",
  "Action": "kms:Decrypt",
  "Resource": "arn:aws:kms:ap-southeast-2:123:key/..."
}

# ===== Versioning =====
# Parameter Store keeps versions automatically:
aws ssm get-parameter-history --name /shop/prod/db/host

# Use a SPECIFIC version:
aws ssm get-parameter --name /shop/prod/db/host:3

# ===== Cost =====
# Standard parameters: free
# Advanced parameters: USD 0.05 per parameter per month
# API calls: USD 0.05 per 10,000 calls (Standard throughput)
# Higher throughput tier: USD 0.05 per 10,000 + USD 0.10 per parameter

# ===== Patterns =====
# - Hierarchical names: /service/env/section/key
# - IAM scoping by path prefix
# - Standard tier for most config; advanced for big values or high throughput
# - Cache in-process; refresh on TTL
# - SecureString for sensitive values; KMS key per environment

# ===== Pitfalls =====
# - Reading on every request -> rate limits + slow
# - Hardcoded paths instead of env-driven
# - Storing secrets in String (plain) instead of SecureString
# - Forgetting KMS Decrypt in IAM
# - Mixing Parameter Store + Secrets Manager without a clear rule

# Simpler config store than Secrets Manager. Free tier covers most needs.