Parameter Store: Standard vs Advanced Parameters

Parameter Store looks like one flat feature until you hit its limits. Then two things become important at once: the Tier (Standard or Advanced), which controls size, account limits, cost, and policy support, and the Type (String, StringList, or SecureString), which controls encryption. This page covers the tier decision and the storage patterns that follow from it.

Recipe

Write a Standard parameter with no Tier argument - it is the default. Standard is free and covers the overwhelming majority of configuration use cases.

# --- Python (boto3) ---
import boto3
 
ssm = boto3.client("ssm", region_name="us-east-1")
ssm.put_parameter(
    Name="/app/prod/feature-flags",
    Value='{"newCheckout": true}',
    Type="String",
    Tier="Standard",   # default; shown here for clarity
)

// --- TypeScript (AWS SDK v3) ---
import { SSMClient, PutParameterCommand } from "@aws-sdk/client-ssm";
 
const ssm = new SSMClient({ region: "us-east-1" });
await ssm.send(new PutParameterCommand({
  Name: "/app/prod/feature-flags",
  Value: JSON.stringify({ newCheckout: true }),
  Type: "String",
  Tier: "Standard",   // default; shown here for clarity
}));

Standard parameters are capped at 4 KB, are free, and count toward a default limit of 10,000 parameters per account per region (a soft limit that can be raised with a service quota increase, though Advanced is the intended path past it).

Working Example

When a value exceeds 4 KB, or you need more than 10,000 parameters, or you need a parameter policy, set Tier: "Advanced" explicitly.

# --- Python (boto3) ---
import boto3
 
ssm = boto3.client("ssm", region_name="us-east-1")
ssm.put_parameter(
    Name="/app/prod/tls-bundle",
    Value=large_pem_bundle,       # up to 8 KB
    Type="String",
    Tier="Advanced",
    Policies='[{"Type":"Expiration","Version":"1.0",'
             '"Attributes":{"Timestamp":"2027-01-01T00:00:00.000Z"}}]',
)

// --- TypeScript (AWS SDK v3) ---
import { SSMClient, PutParameterCommand } from "@aws-sdk/client-ssm";
 
const ssm = new SSMClient({ region: "us-east-1" });
await ssm.send(new PutParameterCommand({
  Name: "/app/prod/tls-bundle",
  Value: largePemBundle,          // up to 8 KB
  Type: "String",
  Tier: "Advanced",
  Policies: JSON.stringify([{
    Type: "Expiration",
    Version: "1.0",
    Attributes: { Timestamp: "2027-01-01T00:00:00.000Z" },
  }]),
}));

Policies is a JSON-encoded string of policy objects, only accepted on Advanced parameters. The Expiration policy above deletes the parameter automatically at the given timestamp - useful for values (like a temporary credential) that should not silently live forever.

Deep Dive

What Actually Differs Between Tiers

Tier is set per parameter at write time via Tier, and (since a later PutParameter with Overwrite: true can change it) a parameter can be promoted from Standard to Advanced later, though never demoted back below its current size if that size exceeds 4 KB.

Type Is a Separate Axis From Tier

Type controls format and encryption, not size or cost:

• String - plain text, no encryption.
• StringList - a comma-separated string the SDK does not otherwise treat specially; you parse it yourself as a list.
• SecureString - encrypted at rest with KMS; requires WithDecryption: true to read the plaintext.

Any combination of Tier and Type is valid: a Standard SecureString and an Advanced SecureString both work the same way with respect to encryption; only size, cost, and policy support change with the tier.

Parameter Policies in Practice

Policies are the main reason to reach for Advanced even when size is not the constraint. ExpirationNotification publishes an EventBridge event some number of days before expiration, letting an automated rotation workflow (or a human) act before a credential goes stale. NoChangeNotification flags a parameter that has not been updated in a given window - useful for catching a rotation job that silently stopped running.

# --- Python (boto3) ---
resp = ssm.get_parameter(Name="/app/prod/tls-bundle")
print(resp["Parameter"].get("Policies"))

// --- TypeScript (AWS SDK v3) ---
const resp = await ssm.send(new GetParameterCommand({ Name: "/app/prod/tls-bundle" }));
console.log(resp.Parameter?.Policies);

GetParameter on an Advanced parameter with policies returns them alongside the value, so monitoring code can check policy status without a separate call.

Gotchas

• Assuming Advanced is free like Standard. Advanced parameters bill per parameter per month regardless of how often they are read; budget for this before converting a large tree wholesale.
• Trying to attach a policy to a Standard parameter. Policies is silently ignored, or rejected, unless Tier is Advanced - set the tier first.
• Confusing Tier with Type. SecureString encryption works on both tiers; choosing Advanced does not itself add encryption, and choosing Standard does not itself remove it.
• Hitting the 4 KB ceiling on a String and not realizing why PutParameter fails. The error names the size limit, but it is easy to miss on a large JSON blob; check size before writing.
• Treating StringList as structured data. It is just a string with commas; the SDK does no parsing, quoting, or escaping for you, so values containing commas need a different type.
• Forgetting the account-wide Standard limit. At scale (thousands of parameters), hitting the default 10,000 limit means either requesting a quota increase or moving new parameters to Advanced.

Alternatives

• AWS Secrets Manager is purpose-built for secrets that need automatic rotation (database credentials, API keys with rotation Lambdas) and has native rotation scheduling that Parameter Store SecureString does not.
• Environment variables baked into a Lambda or container are simpler for a handful of static, non-sensitive values, but they cannot be updated without a redeploy and are not centrally auditable.
• A dedicated config service or feature-flag platform may suit teams needing gradual rollouts or targeting rules well beyond a simple key-value read.

Parameter Store remains the right default for most AWS-native configuration and secrets that do not need automatic rotation, because it is free at Standard tier, requires no extra infrastructure, and integrates directly with IAM.

FAQs

Related

• Systems Manager Basics - the first PutParameter/GetParameter calls, including SecureString.
• Systems Manager as the Fleet Operations Toolkit - how Parameter Store fits with Run Command, Automation, and Session Manager.
• Systems Manager via SDK Best Practices - tiering and secrets hygiene checklist.

Stack versions: This page was written for boto3 1.43.x (Python 3.10+) and the AWS SDK for JavaScript v3 (Node.js 18+).