Question

A company manages application configuration for three environments (dev, staging, prod) using AWS Systems Manager Parameter Store. Each environment's EC2 instances run the same application code but must read environment-specific values (database endpoints, feature flags, API URLs). The DevOps team wants a single reusable deployment mechanism that requires no code changes when promoting the application between environments, while ensuring instances in one environment cannot read another environment's parameters. Which approach best meets these requirements?

Accepted Answer

Store all parameters under a hierarchical path like /app/<env>/... and attach IAM policies to each environment's instance role granting ssm:GetParametersByPath scoped to that environment's path prefix; the application reads its path using an environment variable.

Answer

Store parameters with flat names such as prod-db-endpoint and dev-db-endpoint, and grant every instance role ssm:GetParameter on all parameters, filtering the correct value in application code.

Answer

Create a separate AWS account for each environment and duplicate identical parameter names in each account's Parameter Store, replicating values manually whenever configuration changes.

Answer

Store all configuration as a single SecureString parameter containing a JSON blob for all three environments and grant all instances read access, parsing the relevant environment section at runtime.