Question

A CloudOps engineer manages application configuration for three environments (dev, staging, prod) using AWS Systems Manager Parameter Store. Each environment needs its own database endpoint, feature flags, and API timeout values. The team wants to retrieve all parameters for a single environment in one API call, and apply distinct IAM permissions so that developers can read dev and staging values but only the deployment role can read prod values. What is the MOST effective way to structure the parameters?

Accepted Answer

Create parameters using a hierarchical naming path such as /myapp/dev/db-endpoint and /myapp/prod/db-endpoint, then use GetParametersByPath per environment and scope IAM policies to the corresponding path prefix.

Answer

Store all environment values as a single JSON blob in one SecureString parameter and parse it in the application, using a tag on the parameter to control IAM access.

Answer

Create flat parameter names like dev-db-endpoint and prod-db-endpoint and control access using resource tags on each parameter, retrieving them with individual GetParameter calls.

Answer

Use a separate AWS account for each environment and replicate identical flat parameter names, retrieving them via GetParameters with a list of names.