AWS systems-manager: Add notes on Parameter Store update safety and secrets handling
Summary
Adds notes explaining that parameter updates take effect on next read with no validation/rollback, recommending AWS AppConfig for validated gradual deployments with alarm-based rollback, and recommending AWS Secrets Manager for secrets; also updates CloudWatch naming.
Security assessment
The added notes give security-adjacent operational guidance: they warn that parameter updates are applied without validation or rollback and direct users to AWS Secrets Manager for secrets and to AppConfig for validated, alarm-monitored deployments. This is best-practice guidance rather than a fix for a specific vulnerability.
Evidence
+Environment variables from Parameter Store are resolved when a task starts. A running task needs a new task or a forced deployment to pick up a changed value. For configuration that should update without replacing tasks, run the AWS AppConfig Agent as an additional container to serve the latest values to your application. For secrets, use AWS Secrets Manager. See [What is AWS AppConfig Agent?](https://docs.aws.amazon.com/appconfig/latest/userguide/appconfig-agent.html)
Diff
diff --git a/systems-manager/latest/userguide/systems-manager-parameter-store.md b/systems-manager/latest/userguide/systems-manager-parameter-store.md index c9533f68e..b173db042 100644 --- a//systems-manager/latest/userguide/systems-manager-parameter-store.md +++ b//systems-manager/latest/userguide/systems-manager-parameter-store.md @@ -89 +89 @@ Cost | Standard tier free; advanced tier and higher throughput billed | Billed -Deployment | Versioning without pre-deployment validation or automatic rollback | Gradual rollout, pre-deployment validation, and automatic rollback on CloudWatch Logs alarms | Versioning with staging labels +Deployment | Versioning without pre-deployment validation or automatic rollback | Gradual rollout, pre-deployment validation, and automatic rollback on Amazon CloudWatch alarms | Versioning with staging labels @@ -98,0 +99,4 @@ Update your configuration without code changes or redeployments, improving opera +###### Note + +A parameter update takes effect on the next read, with no validation, gradual rollout, or automatic revert. For configuration where a bad value could cause an outage, AWS AppConfig adds a managed deployment workflow. It validates the change (using JSON Schema or Lambda), rolls it out gradually, and monitors your Amazon CloudWatch alarms. If an alarm is triggered, AWS AppConfig automatically rolls back the change (this requires the necessary IAM permissions). See [Working with deployment strategies](https://docs.aws.amazon.com/appconfig/latest/userguide/appconfig-creating-deployment-strategy.html). + @@ -124,0 +129,4 @@ You can reference parameter values from other AWS services. Here are some exampl +###### Note + +Environment variables from Parameter Store are resolved when a task starts. A running task needs a new task or a forced deployment to pick up a changed value. For configuration that should update without replacing tasks, run the AWS AppConfig Agent as an additional container to serve the latest values to your application. For secrets, use AWS Secrets Manager. See [What is AWS AppConfig Agent?](https://docs.aws.amazon.com/appconfig/latest/userguide/appconfig-agent.html) + @@ -127 +135 @@ You can reference parameter values from other AWS services. Here are some exampl - * AWS AppConfig lets you create [configuration profiles that reference parameters](https://docs.aws.amazon.com/appconfig/latest/userguide/appconfig-creating-free-form-configuration-and-profile-create-console.html). You can safely deploy configuration changes using features such as gradual rollouts, alarm-based rollbacks, and built-in data validation. + * With AWS AppConfig, you can create [configuration profiles that reference a parameter](https://docs.aws.amazon.com/appconfig/latest/userguide/appconfig-creating-free-form-configuration-and-profile-create-console.html) in Parameter Store, adding deployment safety (gradual rollout, validation, and automatic rollback on a configured Amazon CloudWatch alarm) while Parameter Store remains your source.