AWS systems-manager documentation change
Summary
Major restructuring of Parameter Store throughput documentation. Removed sections on resetting throughput and configuring IAM permissions. Added detailed explanations of throughput concepts, relationship to parameter tiers, and cost implications. Simplified console and CLI procedures to focus only on increasing throughput.
Security assessment
This change is a documentation reorganization and clarification of feature usage. It removes detailed IAM policy examples and permission configuration sections, which could be seen as reducing security documentation rather than adding it. There is no evidence of addressing a specific security vulnerability, weakness, or incident. The changes are focused on improving clarity, updating terminology, and streamlining user guidance for throughput management.
Diff
diff --git a/systems-manager/latest/userguide/parameter-store-throughput.md b/systems-manager/latest/userguide/parameter-store-throughput.md index 16c0620f2..5f537a7a3 100644 --- a//systems-manager/latest/userguide/parameter-store-throughput.md +++ b//systems-manager/latest/userguide/parameter-store-throughput.md @@ -7 +7 @@ -Configuring permissions to change Parameter Store throughputIncreasing or resetting throughput using the consoleIncreasing or resetting throughput using the AWS CLIIncreasing or resetting throughput (PowerShell) +Increasing throughput using the consoleIncreasing throughput using the AWS CLIIncreasing throughput (PowerShell) @@ -9 +9 @@ Configuring permissions to change Parameter Store throughputIncreasing or resett -# Increasing or resetting Parameter Store throughput +# Changing Parameter Store throughput @@ -11 +11 @@ Configuring permissions to change Parameter Store throughputIncreasing or resett -Increasing Parameter Store throughput increases the maximum number of transactions per second (TPS) that Parameter Store, a tool in AWS Systems Manager, can process. Increased throughput allows you to operate Parameter Store at higher volumes to support applications and workloads that need concurrent access to multiple parameters. You can increase the quota up to the max throughput on the **Settings** tab. +Parameter Store throughput defines the number of API transactions per second (TPS) that Systems Manager can process for [GetParameter](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetParameter.html), [GetParameters](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetParameters.html), and [PutParameter](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_PutParameter.html) API calls for your AWS account and Region. By default, Parameter Store is configured with a standard throughput quota suitable for low- to moderate-volume workloads. Applications that retrieve configuration data infrequently or operate at smaller scale can typically use this default setting without additional cost. @@ -13 +13 @@ Increasing Parameter Store throughput increases the maximum number of transactio -The Parameter Store throughput setting applies to all transactions created by all IAM users in the current AWS account and AWS Region. The throughput setting applies to standard and advanced parameters. +For higher-volume workloads, you can enable higher throughput, which increases the maximum number of supported transactions per second for your account and Region, at a cost. Increased throughput allows you to operate Parameter Store at higher volumes to support applications and workloads that need concurrent access to multiple parameters. If you're experiencing `ThrottlingException: Rate exceeded` errors, we recommend enabling higher throughput. @@ -15 +15 @@ The Parameter Store throughput setting applies to all transactions created by al -###### Note +Throughput operates independently of parameter tiers, but the two are often used together to meet performance and scale requirements: @@ -17 +17 @@ The Parameter Store throughput setting applies to all transactions created by al -Typically, updates are immediately visible in Service Quotas. In rare cases, it can take up to 24 hours for an update to be reflected. +Standard parameters (default tier) are designed for most workloads. They support up to 10,000 parameters per Region, with values up to 4 KB, and incur no additional storage cost. Advanced parameters support larger values (up to 8 KB), higher parameter counts (up to 100,000), and additional features such as parameter policies. These capabilities come with additional charges. @@ -19,70 +19 @@ Typically, updates are immediately visible in Service Quotas. In rare cases, it -For more information about max throughput default and maximum limits, see [AWS Systems Manager endpoints and quotas](https://docs.aws.amazon.com//general/latest/gr/ssm.html#limits_ssm). - -Increasing the throughput quota incurs a charge on your AWS account. For more information, see [AWS Systems Manager Pricing](https://aws.amazon.com/systems-manager/pricing/). - -###### Topics - - * Configuring permissions to change Parameter Store throughput - - * Increasing or resetting throughput using the console - - * Increasing or resetting throughput using the AWS CLI - - * Increasing or resetting throughput (PowerShell) - - - - -## Configuring permissions to change Parameter Store throughput - -Verify that you have permission in IAM to change Parameter Store throughput by doing one of the following: - - * Make sure that the `AdministratorAccess` policy is attached to your IAM entity (user, group, or role). - - * Make sure that you have permission to change the throughput service setting by using the following API operations: - - * [GetServiceSetting](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetServiceSetting.html) - - * [UpdateServiceSetting](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateServiceSetting.html) - - * [ResetServiceSetting](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ResetServiceSetting.html) - - - - -Grant the following permissions to the IAM entity to allow a user to view and change the parameter-throughput setting for parameters in a specific AWS Region in an AWS account. - -JSON - - -**** - - - - { - "Version":"2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "ssm:GetServiceSetting" - ], - "Resource": "*" - }, - { - "Effect": "Allow", - "Action": [ - "ssm:UpdateServiceSetting" - ], - "Resource": "arn:aws:ssm:us-east-1:111122223333:servicesetting/ssm/parameter-store/high-throughput-enabled" - } - ] - } - - -Administrators can specify read-only permission by assigning the following permissions. - -JSON - - -**** +While parameter tiers control storage limits and feature availability, throughput settings control request volume. For example, you might use standard parameters with default throughput for simple applications, or combine advanced parameters with higher throughput to support large-scale, high-frequency access patterns. In general, increasing throughput is necessary when your application exceeds default TPS limits (for example, during bursts of concurrent reads or writes), regardless of which parameter tier you use. @@ -89,0 +21 @@ JSON +You can enable or disable higher throughput at any time from the Parameter Store **Settings** page or by using the AWS CLI. @@ -90,0 +23 @@ JSON +For more information about maximum throughput and other Parameter Store quotas, see [AWS Systems Manager endpoints and quotas](https://docs.aws.amazon.com//general/latest/gr/ssm.html#limits_ssm). @@ -92,20 +25 @@ JSON - { - "Version":"2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "ssm:GetServiceSetting" - ], - "Resource": "*" - }, - { - "Effect": "Deny", - "Action": [ - "ssm:ResetServiceSetting", - "ssm:UpdateServiceSetting" - ], - "Resource": "*" - } - ] - } +###### Important @@ -112,0 +27 @@ JSON +Increasing the throughput quota incurs a charge on your AWS account. For more information, see [AWS Systems Manager Pricing](https://aws.amazon.com/systems-manager/pricing/). @@ -114,9 +29 @@ JSON -To provide access, add permissions to your users, groups, or roles: - - * Users and groups in AWS IAM Identity Center: - -Create a permission set. Follow the instructions in [Create a permission set](https://docs.aws.amazon.com//singlesignon/latest/userguide/howtocreatepermissionset.html) in the _AWS IAM Identity Center User Guide_. - - * Users managed in IAM through an identity provider: - -Create a role for identity federation. Follow the instructions in [Create a role for a third-party identity provider (federation)](https://docs.aws.amazon.com//IAM/latest/UserGuide/id_roles_create_for-idp.html) in the _IAM User Guide_. +###### Topics @@ -124 +31 @@ Create a role for identity federation. Follow the instructions in [Create a role - * IAM users: + * Increasing throughput using the console @@ -126 +33 @@ Create a role for identity federation. Follow the instructions in [Create a role - * Create a role that your user can assume. Follow the instructions in [Create a role for an IAM user](https://docs.aws.amazon.com//IAM/latest/UserGuide/id_roles_create_for-user.html) in the _IAM User Guide_. + * Increasing throughput using the AWS CLI @@ -128 +35 @@ Create a role for identity federation. Follow the instructions in [Create a role - * (Not recommended) Attach a policy directly to a user or add a user to a user group. Follow the instructions in [Adding permissions to a user (console)](https://docs.aws.amazon.com//IAM/latest/UserGuide/id_users_change-permissions.html#users_change_permissions-add-console) in the _IAM User Guide_. + * Increasing throughput (PowerShell) @@ -133 +40 @@ Create a role for identity federation. Follow the instructions in [Create a role -## Increasing or resetting throughput using the console +## Increasing throughput using the console @@ -135 +42 @@ Create a role for identity federation. Follow the instructions in [Create a role -The following procedure shows how to use the Systems Manager console to increase the number of transactions per second that Parameter Store can process for the current AWS account and AWS Region. It also shows how to revert to the standard settings if you no longer need increased throughput or no longer want to incur charges. +The following procedure describes how to use the Systems Manager console to increase the number of transactions per second that Parameter Store can process for the current AWS account and AWS Region. @@ -137 +44 @@ The following procedure shows how to use the Systems Manager console to increase -###### To increase or reset Parameter Store throughput using the console +###### To increase Parameter Store throughput using the console @@ -141 +48 @@ The following procedure shows how to use the Systems Manager console to increase -If you haven't created a parameter yet, you can use the AWS Command Line Interface (AWS CLI) or AWS Tools for Windows PowerShell to increase throughput. For information, see Increasing or resetting throughput using the AWS CLI and Increasing or resetting throughput (PowerShell). +If you haven't created a parameter yet, you can use the AWS Command Line Interface (AWS CLI) or AWS Tools for Windows PowerShell to increase throughput. For information, see Increasing throughput using the AWS CLI and Increasing throughput (PowerShell). @@ -149,9 +56 @@ If you haven't created a parameter yet, you can use the AWS Command Line Interfa - 4. To increase throughput, choose **Set limit**. - --or- - -To revert to the default limit, choose **Reset limit**. - - 5. If you are increasing the limit, do the following: - - * Select the check box for **I accept that changing this setting incurs charges on my AWS account**. + 4. Choose the **Manage settings**. @@ -159 +58 @@ To revert to the default limit, choose **Reset limit**. - * Choose **Set limit**. + 5. In the **Parameter throughput** section, choose an option. @@ -161 +60 @@ To revert to the default limit, choose **Reset limit**. --or- + 6. If prompted, select the option to approve the changes and authorize charges. Choose **Save settings**. @@ -163 +61,0 @@ To revert to the default limit, choose **Reset limit**. -If you are resetting the limit to the default, do the following: @@ -165 +62,0 @@ If you are resetting the limit to the default, do the following: - * Select the check box for **I accept that resetting to the default throughput limit causes Parameter Store to process fewer transactions per second**. @@ -167 +63,0 @@ If you are resetting the limit to the default, do the following: - * Choose **Reset limit**. @@ -168,0 +65 @@ If you are resetting the limit to the default, do the following: +## Increasing throughput using the AWS CLI @@ -170,5 +67 @@ If you are resetting the limit to the default, do the following: - - -## Increasing or resetting throughput using the AWS CLI - -The following procedure shows how to use the AWS CLI to increase the number of transactions per second that Parameter Store can process for the current AWS account and AWS Region. You can also revert to the default limit. +The following procedure shows how to use the AWS CLI to increase the number of transactions per second that Parameter Store can process for the current AWS account and AWS Region. @@ -204,2 +97 @@ The system returns information similar to the following: -If you no longer need increased throughput, or if you no longer want to incur charges, you can revert to the standard settings. To revert your settings, run the following command. - +## Increasing throughput (PowerShell) @@ -207,17 +99 @@ If you no longer need increased throughput, or if you no longer want to incur ch - aws ssm reset-service-setting --setting-id arn:aws:ssm:region:account-id:servicesetting/ssm/parameter-store/high-throughput-enabled - - - { - "ServiceSetting": { - "SettingId": "/ssm/parameter-store/high-throughput-enabled", - "SettingValue": "false", - "LastModifiedDate": 1555532818.578, - "LastModifiedUser": "System",