AWS systems-manager documentation change
Summary
Major restructuring of the Parameter Store documentation. The document was simplified from a comprehensive guide covering default parameter tiers and conversion procedures to a focused overview of standard vs. advanced parameters. Detailed sections on specifying default tiers (including console/CLI/PowerShell instructions, permissions, and Intelligent-Tiering benefits) and changing parameter tiers were removed and replaced with links to separate pages. The comparison table was retained but moved.
Security assessment
The changes are purely organizational and structural, moving detailed operational content to separate pages. There is no evidence of addressing a security vulnerability, incident, or weakness. The mention of encryption changes when reverting parameters is a clarification of existing functionality, not a response to a security issue. No new security features are documented.
Diff
diff --git a/systems-manager/latest/userguide/parameter-store-advanced-parameters.md b/systems-manager/latest/userguide/parameter-store-advanced-parameters.md index fb0058be2..6ecdb95ac 100644 --- a//systems-manager/latest/userguide/parameter-store-advanced-parameters.md +++ b//systems-manager/latest/userguide/parameter-store-advanced-parameters.md @@ -7 +7 @@ -Specifying a default parameter tierChanging a standard parameter to an advanced parameter +Standard and advanced parameters @@ -11 +11 @@ Specifying a default parameter tierChanging a standard parameter to an advanced -Parameter Store, a tool in AWS Systems Manager, includes _standard parameters_ and _advanced parameters_. You individually configure parameters to use either the standard-parameter tier (the default tier) or the advanced-parameter tier. +Parameter Store includes _standard parameters_ and _advanced parameters_. You individually configure parameters to use either the standard-parameter tier (the default tier) or the advanced-parameter tier. @@ -13 +13 @@ Parameter Store, a tool in AWS Systems Manager, includes _standard parameters_ a -You can change a standard parameter to an advanced parameter at any time, but you can’t revert an advanced parameter to a standard parameter. This is because reverting an advanced parameter to a standard parameter would cause the system to truncate the size of the parameter from 8 KB to 4 KB, resulting in data loss. Reverting would also remove any policies attached to the parameter. Also, advanced parameters use a different form of encryption than standard parameters. For more information, see [How AWS Systems Manager Parameter Store uses AWS KMS](https://docs.aws.amazon.com/kms/latest/developerguide/services-parameter-store.html) in the _AWS Key Management Service Developer Guide_. +You can change a standard parameter to an advanced parameter at any time. You _can’t_ change an advanced parameter to a standard parameter for the following reasons: @@ -15,68 +15 @@ You can change a standard parameter to an advanced parameter at any time, but yo -If you no longer need an advanced parameter, or if you no longer want to incur charges for an advanced parameter, delete it and recreate it as a new standard parameter. - -The following table describes the differences between the tiers. - -| Standard | Advanced ----|---|--- -Total number of parameters allowed (per AWS account and AWS Region) | 10,000 | 100,000 -Maximum size of a parameter value | 4 KB | 8 KB -Parameter policies available | No | Yes For more information, see [Assigning parameter policies in Parameter Store](./parameter-store-policies.html). -Cost | No additional charge | Charges apply For more information, see [AWS Systems Manager Pricing for Parameter Store](https://aws.amazon.com/systems-manager/pricing/#Parameter_Store). - -###### Topics - - * Specifying a default parameter tier - - * Changing a standard parameter to an advanced parameter - - - - -## Specifying a default parameter tier - -In requests to create or update a parameter (that is, the `[PutParameter](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_PutParameter.html)` operation), you can specify the parameter tier to use in the request. The following is an example, using the AWS Command Line Interface (AWS CLI). - -Linux & macOS - - - - aws ssm put-parameter \ - --name "default-ami" \ - --type "String" \ - --value "t2.micro" \ - --tier "Standard" - -Windows - - - - aws ssm put-parameter ^ - --name "default-ami" ^ - --type "String" ^ - --value "t2.micro" ^ - --tier "Standard" - -Whenever you specify a tier in the request, Parameter Store creates or updates the parameter according to your request. However, if you don't explicitly specify a tier in a request, the Parameter Store default tier setting determines which tier the parameter is created in. - -The default tier when you begin using Parameter Store is the standard-parameter tier. If you use the advanced-parameter tier, you can specify one of the following as the default: - - * **Advanced** : With this option, Parameter Store evaluates all requests as advanced parameters. - - * **Intelligent-Tiering** : With this option, Parameter Store evaluates each request to determine if the parameter is standard or advanced. - -If the request doesn't include any options that require an advanced parameter, the parameter is created in the standard-parameter tier. If one or more options requiring an advanced parameter are included in the request, Parameter Store creates a parameter in the advanced-parameter tier. - - - - -###### Benefits of Intelligent-Tiering - -The following are reasons you might choose Intelligent-Tiering as the default tier. - -**Cost control** – Intelligent-Tiering helps control your parameter-related costs by always creating standard parameters unless an advanced parameter is absolutely necessary. - -**Automatic upgrade to the advanced-parameter tier** – When you make a change to your code that requires upgrading a standard parameter to an advanced parameter, Intelligent-Tiering handles the conversion for you. You don't need to change your code to handle the upgrade. - -Here are some examples of automatic upgrades: - - * Your AWS CloudFormation templates provision numerous parameters when they're run. When this process causes you to reach the 10,000 parameter quota in the standard-parameter tier, Intelligent-Tiering automatically upgrades you to the advanced-parameter tier, and your CloudFormation processes aren't interrupted. + * Reverting would cause the system to truncate the size of the parameter from 8 KB to 4 KB, resulting in data loss. @@ -84 +17 @@ Here are some examples of automatic upgrades: - * You store a certificate value in a parameter, rotate the certificate value regularly, and the content is less than the 4 KB quota of the standard-parameter tier. If a replacement certificate value exceeds 4 KB, Intelligent-Tiering automatically upgrades the parameter to the advanced-parameter tier. + * Reverting would remove policies attached to the parameter. @@ -86 +19 @@ Here are some examples of automatic upgrades: - * You want to associate numerous existing standard parameters to a parameter policy, which requires the advanced-parameter tier. Instead of your having to include the option `--tier Advanced` in all the calls to update the parameters, Intelligent-Tiering automatically upgrades the parameters to the advanced-parameter tier. The Intelligent-Tiering option upgrades parameters from standard to advanced whenever criteria for the advanced-parameter tier are introduced. + * Reverting would change the parameter encryption. @@ -91,18 +24 @@ Here are some examples of automatic upgrades: -Options that require an advanced parameter include the following: - - * The content size of the parameter is more than 4 KB. - - * The parameter uses a parameter policy. - - * More than 10,000 parameters already exist in your AWS account in the current AWS Region. - - - - -###### Default Tier Options - -The tier options you can specify as the default include the following. - - * **Standard** – The standard-parameter tier is the default tier when you begin to use Parameter Store. Using the standard-parameter tier, you can create 10,000 parameters for each AWS Region in an AWS account. The content size of each parameter can equal a maximum of 4 KB. Standard parameters don't support parameter policies. There is no additional charge to use the standard-parameter tier. Choosing **Standard** as the default tier means that Parameter Store always attempts to create a standard parameter for requests that don't specify a tier. - - * **Advanced** – Use the advanced-parameter tier to create a maximum of 100,000 parameters for each AWS Region in an AWS account. The content size of each parameter can equal a maximum of 8 KB. Advanced parameters support parameter policies. To share a parameter, it must be in the advanced parameter tier. There is a charge to use the advanced-parameter tier. For more information, see [AWS Systems Manager Pricing for Parameter Store](https://aws.amazon.com/systems-manager/pricing/#Parameter_Store). Choosing **Advanced** as the default tier means that Parameter Store always attempts to create an advanced parameter for requests that don't specify a tier. +For information about encryption used by Parameter Store, see [How AWS Systems Manager Parameter Store uses AWS KMS](https://docs.aws.amazon.com/kms/latest/developerguide/services-parameter-store.html) in the _AWS Key Management Service Developer Guide_. @@ -112,227 +28 @@ The tier options you can specify as the default include the following. -When you choose the advanced-parameter tier, explicitly authorize AWS to charge your account for any advanced parameters you create. - - * **Intelligent-Tiering** – With the Intelligent-Tiering option, Parameter Store determines whether to use the standard-parameter tier or advanced-parameter tier based on the content of the request. For example, if you run a command to create a parameter with content under 4 KB, and there are fewer than 10,000 parameters in the current AWS Region in your AWS account, and you don't specify a parameter policy, a standard parameter is created. If you run a command to create a parameter with more than 4 KB of content, you already have more than 10,000 parameters in the current AWS Region in your AWS account, or you specify a parameter policy, an advanced parameter is created. - -###### Note - -When you choose Intelligent-Tiering, explicitly authorize AWS to charge your account for any advanced parameters you created. - - - - -You can change the Parameter Store default tier setting at any time. - -### Configuring permissions to specify a Parameter Store default tier - -Verify that you have permission in AWS Identity and Access Management (IAM) to change the default parameter tier in Parameter Store by doing one of the following: - - * Make sure that you attach the `AdministratorAccess` policy to your IAM entity (such as user, group, or role). - - * Make sure that you have permission to change the default tier setting by using the following API operations: - - * [GetServiceSetting](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetServiceSetting.html) - - * [UpdateServiceSetting](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateServiceSetting.html) - - * [ResetServiceSetting](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ResetServiceSetting.html) - - - - -Grant the following permissions to the IAM entity to allow a user to view and change the default tier setting for parameters in a specific AWS Region in an AWS account. - -JSON - - -**** - - - - { - "Version":"2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "ssm:GetServiceSetting" - ], - "Resource": "*" - }, - { - "Effect": "Allow", - "Action": [ - "ssm:UpdateServiceSetting" - ], - "Resource": "arn:aws:ssm:us-east-1:111122223333:servicesetting/ssm/parameter-store/default-parameter-tier" - } - ] - } - - -Administrators can specify read-only permission by assigning the following permissions. - -JSON - - -**** - - - - { - "Version":"2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "ssm:GetServiceSetting" - ], - "Resource": "*" - }, - { - "Effect": "Deny", - "Action": [ - "ssm:ResetServiceSetting", - "ssm:UpdateServiceSetting" - ], - "Resource": "*" - } - ] - } -