Using the Secure String Parameter in Systems Manager Parameter Store

What is AWS Systems Manager Parameter Store

AWS Systems Manager Parameter Store helps you securely store and share key-value pairs across your AWS environment. It is one of the packages under AWS Systems Manager that helps you design a more robust and abstract infrastructure. With Parameter Store, you don’t have to hard code parameters nor save them in config files for application use. You can easily reference them in your applications and AWS resources using the unique parameter store key of those items. 

Parameter Store supports a lot of use cases, from saving unencrypted plaintext to more sensitive information such as database passwords. You can also store configuration data and secure strings in hierarchies and track versions. During parameter creation, you specify the data type of your string:

  • String – Any string value.
  • StringList – Separate strings using commas.
  • SecureString – Encrypt sensitive data using the KMS keys for your account

For parameters that should not be retrieved or referenced in plaintext, it is best to use the SecureString data type.

IT Certification Category (English)728x90

How to Secure Parameters in Parameter Store

Sensitive information, such as passwords and secrets, should never be left exposed as is. Parameter Store solves this problem by offering the SecureString data type, which uses AWS KMS to protect your information. AWS KMS uses either a customer managed CMK or an AWS-managed CMK when encrypting the parameter value. Then in the application that references the parameter, you must set WithDecryption to True to use the original parameter value.

To create a secure parameter in the console, 

  1. Go to AWS Systems Manager and select Parameter Store

Systems Manager Parameter Store

 2. On the create parameter page, give your parameter a name and an optional description

 3. Choose SecureString data type and select the AWS KMS key that you want to use

Systems Manager Parameter Store

 4. Lastly, enter the value of your parameter, add some tags, and click Create parameter

Systems Manager Parameter Store

If you check the details of your parameter, you can see that the value is replaced by asterisks, to keep your information from being exposed to the public.

How to reference your SecureString parameter

To retrieve your parameters, use the AWS SSM GetParameters API call in your script or code.

Request Syntax

Systems Manager Parameter Store

  • In the Names section, include all the parameters that you want to retrieve. 
  • If those parameters are encrypted through SecureString, be sure to set WithDecryption to True if you need the unencrypted value of the parameter.
    • If you cannot decrypt the parameters, check if your account has the necessary permissions to decrypt information using that AWS KMS key.

Final thoughts

AWS Systems Manager Parameter Store really comes in handy when you want to build robust and abstract systems in AWS. Information does not need to be stored within the application anymore, and it can also be shared among different applications in a simple and secure way. SecureString is very helpful in protecting sensitive information and making sure that only the right people have access to it.

Sources:
https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html
https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-paramstore-securestring.html

***

AWS Certifications are consistently among the top paying IT certifications in the world, considering that Amazon Web Services is the leading cloud services platform with almost 50% market share! Earn over $150,000 per year with an AWS certification!

Subscribe to our newsletter and notifications for more helpful AWS cheat sheets and study guides like this and answer as many AWS practice exams as you can.🙂

NEW eBook – Solutions Architect Associate Exam Study Guide and Cheat Sheets

AWS Certified Solutions Architect Associate eBook version2

NEW Course – AWS Certified Security Specialty Practice Exams 2020

AWS Certified Security - Specialty Exam Study Path

Enroll Now – AWS Certified Cloud Practitioner Practice Exams 2020

AWS Certified Cloud Practitioner New

Enroll Now – AWS Certified Solutions Architect Associate Practice Exams 2020

AWS Certified Solutions Architect Associate Practice Exams New

Enroll Now – AWS Certified Developer Associate Practice Exams 2020

AWS Certified Developer Associate New

Enroll Now – AWS Certified SysOps Administrator Associate Practice Exams 2020

AWS Certified SysOps Administrator Associate New

Enroll Now – AWS Certified Solutions Architect Professional Practice Exams 2020

AWS Certified Solutions Architect Professional New

Enroll Now – AWS Certified DevOps Engineer Professional Practice Exams 2020

AWS Certified DevOps Engineer Professional Practice Exams New

Browse Other Courses

Generic Category (English)300x250

Recent Posts