AWS Cloud Studies > AWS SSM Parameter Store Flashcards > Flashcards

AWS SSM Parameter Store Flashcards

(80 cards)

Study These Flashcards
1
Q

What is AWS Systems Manager Parameter Store?

A

A managed service to store configuration data and secrets securely, centrally, and in a hierarchical structure for applications and infrastructure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What types of data can Parameter Store manage?

A

Plaintext, SecureString (encrypted), and StringList.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the difference between String and SecureString parameters?

A

String is plaintext, while SecureString is encrypted using AWS KMS keys for security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How does Parameter Store integrate with AWS KMS?

A

SecureString parameters can be encrypted with a customer-managed KMS key or the default AWS-managed key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are Hierarchical Parameters?

A

Parameters can be stored in a path-like hierarchy, e.g., /prod/db/username, allowing logical grouping.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the maximum size of a parameter value?

A

4 KB for standard parameters; 8 KB for advanced parameters.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the difference between standard and advanced parameters?

A

Standard: free, 10,000 max, 4 KB, 1 per second throughput. Advanced: paid, 100,000 max, 8 KB, higher throughput, supports policies, larger value sizes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Can you attach policies to parameters?

A

Yes, advanced parameters support parameter policies for expiration, rotation, and notifications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How can applications access Parameter Store securely?

A

Via AWS SDKs, CLI, or by assigning IAM roles/policies to EC2, Lambda, or other services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is Parameter Versioning?

A

Parameter Store automatically maintains versions of parameters each time they are updated, allowing rollback.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How do you create a parameter using AWS CLI?

A

aws ssm put-parameter –name “/prod/db/password” –value “MySecret” –type SecureString

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How do you retrieve a parameter value from Parameter Store?

A

aws ssm get-parameter –name “/prod/db/password” –with-decryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How do you retrieve multiple parameters under a path?

A

aws ssm get-parameters-by-path –path “/prod/db/” –recursive –with-decryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How do you update a parameter?

A

aws ssm put-parameter –name “/prod/db/password” –value “NewSecret” –type SecureString –overwrite

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How do you delete a parameter?

A

aws ssm delete-parameter –name “/prod/db/password”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How do you list all parameters?

A

aws ssm describe-parameters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How can Parameter Store integrate with EC2, Lambda, or ECS?

A

Use IAM roles to allow services to call GetParameter API at runtime to fetch config or secrets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the difference between GetParameter and GetParameters?

A

GetParameter fetches a single parameter; GetParameters fetches multiple parameters at once.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Should you use Parameter Store for sensitive data?

A

Yes, use SecureString with KMS encryption.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How should you manage parameter versioning?

A

Always use versioning to allow safe rollback of changes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

When should you use advanced parameters?

A

When you need larger values, parameter policies, or higher throughput.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

How do you structure hierarchical parameters?

A

Use paths like /environment/service/config to keep parameters organized.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Can Parameter Store replace AWS Secrets Manager?

A

For basic secrets, yes, but Secrets Manager offers rotation, replication, and secret lifecycle management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

How would you store database credentials securely for a Lambda function?

A

Store as SecureString in Parameter Store, encrypt with KMS, and give Lambda an IAM role to access the parameter.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
How can you rotate secrets stored in Parameter Store automatically?
Use Parameter Policies for rotation, or integrate with Lambda to programmatically update SecureString values.
26
How can you avoid exposing secrets in logs?
Always retrieve SecureString parameters with --with-decryption in memory only, and avoid logging the value.
27
How would you structure parameters for multiple environments (dev, test, prod)?
Use a path hierarchy, e.g., /dev/db/password, /test/db/password, /prod/db/password.
28
How can you handle large sets of configuration data?
Use StringList parameters or multiple hierarchical parameters with paths.
29
What is AWS Systems Manager Parameter Store?
A managed service to store configuration data and secrets securely, centrally, and hierarchically.
30
What types of data can Parameter Store manage?
String, SecureString (encrypted), and StringList.
31
What is the difference between String and SecureString?
String is plaintext; SecureString is encrypted using AWS KMS.
32
What is a StringList parameter?
A comma-separated list of string values stored as a single parameter.
33
What is the maximum size for standard parameters?
4 KB per parameter.
34
What is the maximum size for advanced parameters?
8 KB per parameter.
35
How does Parameter Store handle versioning?
Each parameter update creates a new version, allowing rollback.
36
What is the difference between standard and advanced parameters?
Advanced parameters support larger size, more versions, higher throughput, policies, and are billed.
37
How are parameters structured hierarchically?
Using path-like names, e.g., /prod/db/username.
38
How does Parameter Store integrate with AWS KMS?
SecureString parameters can be encrypted with AWS-managed or customer-managed KMS keys.
39
When should you use SecureString?
For secrets such as passwords, API keys, or tokens.
40
When is StringList useful?
Storing multiple related values in one parameter, like multiple database endpoints.
41
Can SecureString be decrypted automatically by AWS services?
Yes, if the service has IAM permissions and uses the --with-decryption flag.
42
Can Parameter Store replace Secrets Manager?
For basic secrets, yes, but Secrets Manager supports automatic rotation and lifecycle management.
43
How do you specify a custom KMS key for a SecureString?
Using --key-id when creating the parameter via CLI or SDK.
44
How do you create a standard string parameter?
aws ssm put-parameter --name "/prod/app/config" --value "value" --type String
45
How do you create a SecureString parameter?
aws ssm put-parameter --name "/prod/db/password" --value "secret" --type SecureString --key-id "alias/my-key"
46
How do you update a parameter without creating a new version?
You cannot; updates create a new version automatically. Use --overwrite to update.
47
How do you retrieve a single parameter value?
aws ssm get-parameter --name "/prod/db/password" --with-decryption
48
How do you retrieve multiple parameters at once?
aws ssm get-parameters --names "/prod/db/password" "/prod/db/username" --with-decryption
49
How do you retrieve all parameters under a path?
aws ssm get-parameters-by-path --path "/prod/db/" --recursive --with-decryption
50
How do you delete a parameter?
aws ssm delete-parameter --name "/prod/db/password"
51
How do you list all parameters?
aws ssm describe-parameters
52
How do you filter parameters by type?
aws ssm describe-parameters --parameter-filters Key=Type,Values=SecureString
53
How do you get a parameter version?
The Version field in get-parameter response indicates it.
54
How can you retrieve a parameter in Python (Boto3)?
ssm.get_parameter(Name='/prod/db/password', WithDecryption=True)
55
How can Lambda securely access Parameter Store?
Assign an IAM role with ssm:GetParameter permissions and call the SDK in code.
56
Can CloudFormation manage Parameter Store parameters?
Yes, using AWS::SSM::Parameter resource type.
57
How do you reference Parameter Store values in CloudFormation templates?
{{resolve:ssm:/path/to/parameter:version}} for standard, or {{resolve:ssm-secure:/path/to/parameter:version}} for SecureString.
58
How can you use Parameter Store with ECS tasks?
Use secrets in task definitions referencing the SSM parameter ARN.
59
Can SSM Parameters be used in CodePipeline?
Yes, parameters can be injected as environment variables for deployment steps.
60
What are parameter policies?
Rules applied to parameters for expiration, rotation, or notifications.
61
How can you enforce automatic parameter expiration?
Create a parameter policy of type Expiration.
62
Can you rotate SecureString parameters automatically?
Yes, using parameter policies with Lambda rotation functions.
63
What is a parameter policy for change notification?
Sends events to Amazon EventBridge when a parameter changes.
64
How many versions does Parameter Store retain by default?
Standard: 100; Advanced: configurable, up to 100.
65
What is the max number of parameters per AWS account?
Standard: 10,000; Advanced: 100,000 (limits can increase on request).
66
How can you audit access to Parameter Store?
Enable AWS CloudTrail logging for API calls.
67
Can you tag parameters?
Yes, using standard AWS tagging.
68
Should you store sensitive data in plaintext?
No, always use SecureString with KMS encryption.
69
How should IAM policies be structured for Parameter Store?
Use least privilege: allow only services/users that need access.
70
How do you prevent secrets from leaking in logs?
Retrieve parameters in memory only, do not log decrypted values.
71
How should parameters be structured for multiple environments?
Use a hierarchical naming convention: /dev/service/param, /prod/service/param.
72
How can you secure cross-account access?
Use resource-based policies with ssm:ResourceTag or KMS key policies.
73
How do you rotate secrets without downtime?
Use versioned parameters with Lambda rotation and update references atomically.
74
How would you store database credentials securely for Lambda?
Store as SecureString in Parameter Store, encrypt with KMS, and assign Lambda an IAM role for access.
75
How would you structure parameters for multiple services?
Use paths per service, e.g., /prod/service1/db, /prod/service2/api.
76
How do you handle large lists of endpoints?
Use StringList parameters or multiple hierarchical parameters.
77
How do you integrate Parameter Store with ECS tasks?
Reference SecureString parameters in secrets section of task definitions.
78
How do you ensure applications use the latest secret version?
Applications call get-parameter each time they start or periodically refresh cache.
79
How can Parameter Store help with zero-downtime deployments?
Store config and secrets externally; update parameters without changing code, services fetch updated values at runtime.
80
How do you migrate secrets from Parameter Store to Secrets Manager?
Export values securely and recreate them in Secrets Manager; update applications to reference Secrets Manager ARN.
AWS Cloud Studies
flashcards
Decks in class (32)
# Cards
Brainscape helps you reach your goals faster, through stronger study habits.
© 2026 Bold Learning Solutions. Terms and Conditions