Question

A company manages application configuration for a fleet of EC2 instances across 200 accounts. They currently store the config as JSON files baked into AMIs and re-deploy AMIs whenever a value changes, which takes hours. The DevOps team wants a solution where operators can update non-secret configuration values (feature flags, timeouts, endpoints) centrally and have running instances pick up changes within minutes without redeploying instances. Changes must be version-tracked and auditable, and the solution must integrate with their existing CloudFormation-based provisioning. Which approach best meets these requirements?

Accepted Answer

Store the configuration values as SSM Parameter Store parameters organized in a hierarchy, reference them in the application via the SSM API/agent, and provision the parameters through CloudFormation; use Parameter Store versioning and CloudTrail for audit.

Answer

Continue baking config into AMIs but automate the AMI build with EC2 Image Builder pipelines triggered by CloudFormation stack updates so rebuilds finish faster.

Answer

Store each configuration value as a CloudFormation stack output and use CloudFormation StackSets to push updated stacks to all 200 accounts whenever a value changes.

Answer

Place the configuration in AWS Secrets Manager with automatic rotation enabled and have the application fetch values on each request through the Secrets Manager cache.