Using the Secure String Parameter in Systems Manager Parameter Store

What is AWS Systems Manager Parameter Store

AWS Systems Manager Parameter Store helps you securely store and share key-value pairs across your AWS environment. It is one of the packages under AWS Systems Manager that helps you design a more robust and abstract infrastructure. With Parameter Store, you don’t have to hard code parameters nor save them in config files for application use. You can easily reference them in your applications and AWS resources using the unique parameter store key of those items. 

Parameter Store supports a lot of use cases, from saving unencrypted plaintext to more sensitive information such as database passwords. You can also store configuration data and secure strings in hierarchies and track versions. During parameter creation, you specify the data type of your string:

  • String – Any string value.
  • StringList – Separate strings using commas.
  • SecureString – Encrypt sensitive data using the KMS keys for your account

For parameters that should not be retrieved or referenced in plaintext, it is best to use the SecureString data type.

How to Secure Parameters in Parameter Store

IT Certification Category (English)728x90

Sensitive information, such as passwords and secrets, should never be left exposed as is. Parameter Store solves this problem by offering the SecureString data type, which uses AWS KMS to protect your information. AWS KMS uses either a customer managed CMK or an AWS-managed CMK when encrypting the parameter value. Then in the application that references the parameter, you must set WithDecryption to True to use the original parameter value.

To create a secure parameter in the console, 

  1. Go to AWS Systems Manager and select Parameter Store

Systems Manager Parameter Store

 2. On the create parameter page, give your parameter a name and an optional description

 3. Choose SecureString data type and select the AWS KMS key that you want to use

Systems Manager Parameter Store

 4. Lastly, enter the value of your parameter, add some tags, and click Create parameter

Systems Manager Parameter Store

If you check the details of your parameter, you can see that the value is replaced by asterisks, to keep your information from being exposed to the public.

How to reference your SecureString parameter

To retrieve your parameters, use the AWS SSM GetParameters API call in your script or code.

Request Syntax

Systems Manager Parameter Store

  • In the Names section, include all the parameters that you want to retrieve. 
  • If those parameters are encrypted through SecureString, be sure to set WithDecryption to True if you need the unencrypted value of the parameter.
    • If you cannot decrypt the parameters, check if your account has the necessary permissions to decrypt information using that AWS KMS key.

Final thoughts

AWS Systems Manager Parameter Store really comes in handy when you want to build robust and abstract systems in AWS. Information does not need to be stored within the application anymore, and it can also be shared among different applications in a simple and secure way. SecureString is very helpful in protecting sensitive information and making sure that only the right people have access to it.

Note: If you are studying for the AWS Certified Security Specialty exam, we highly recommend that you take our AWS Certified Security – Specialty Practice Exams and read our Security Specialty exam study guide.

AWS Certified Security - Specialty Exam Study Path


Pass your AWS and Azure Certifications with the Tutorials Dojo Portal

Tutorials Dojo portal

Our Bestselling AWS Certified Solutions Architect Associate Practice Exams

AWS Certified Solutions Architect Associate Practice Exams

Enroll Now – Our AWS Practice Exams with 95% Passing Rate

AWS Practice Exams Tutorials Dojo

Enroll Now – Our Azure Certification Exam Reviewers

azure reviewers tutorials dojo

Tutorials Dojo Study Guide and Cheat Sheets eBooks

Tutorials Dojo Study Guide and Cheat Sheets-2

FREE Intro to Cloud Computing for Beginners

FREE AWS Practice Test Samplers

Browse Other Courses

Generic Category (English)300x250

Recent Posts