AWS SSM parameter store reliability

Question

I am looking at using AWS SSM Parameter Store to store secrets such as database connection strings for applications deployed on EC2, Elastic Beanstalk, Fargate docker containers etc).

The linked document states that the service is Highly scalable, available, and durable, but I can't find more details on what exactly that means. For example, is it replicated across all regions?

Is it best to:

a) read secrets from the parameter store at application startup (i.e. rely on it being highly available and scalable, even if, say, another region has gone down)?

or

b) read and store secrets locally when the application is deployed? Arguably less secure, but it means that any unavailability of the Parameter Store service would only impact deployment of new versions.

What happens if parameters change? Like if a password is rotated. — myron-semack
@myron-semack Secrets Manager will publish an event via CloudTrail - 'RotationSucceeded' when there is a successful rotation. You can use this event to further automate how you want your system to behave in this case. — Nikita Fedyashev

titogeo titogeo · Accepted Answer · 2018-09-14T16:12:44

If you want to go with the parameter store go with your option a. And fail the app if get parameter call failed. (This happens, I have seen rate limiting happening for Parameter Store API requests) See here.

Or

The best option is AWS secrets manager. Secrets manager is a superset of the parameter store. It supports RDS password rotation and many more. Also its paid.

AWS SSM parameter store reliability

2 Answers