AWS SDK Secrets Manager and SSM Parameter Store: Read Config Safely (Python, PHP, Node.js)

By Ravindra Bagale, trainer · LinkedIn · Last updated: 24 October 2026

1. The big picture: the hotel safe

Why do we need this?

You do not tape your passport to the hotel door. You lock it in the room safe and open it when needed. Secrets Manager is the safe for passwords; Parameter Store is the notice board for settings, with a locked section for sensitive ones.

What is it?

GetSecretValue returns SecretString. GetParameter with WithDecryption reads a SecureString. Both are encrypted with KMS; IAM decides who can read.

How to do it (step by step)

2. Create and read a secret

Why do we need this?

Lucas needs the Postgres password for the Brazil database without anyone seeing it in code.

What is it?

Store JSON in SecretString so one secret holds username, password, host. Read it and parse the JSON.

How to do it (step by step)

1. Python: create the secret.

import boto3, json
sm = boto3.client("secretsmanager", region_name="sa-east-1")
r = sm.create_secret(Name="payments/db",
    SecretString=json.dumps({"user": "pay_app", "password": "Xy7!q2-Lm9", "host": "db.internal", "port": 5432}))
print(r["ARN"])

Expected output:

arn:aws:secretsmanager:sa-east-1:123456789012:secret:payments/db-AbCdEf

2. Node.js: read and parse it.

import { SecretsManagerClient, GetSecretValueCommand } from "@aws-sdk/client-secrets-manager";
const sm = new SecretsManagerClient({ region: "sa-east-1" });
const { SecretString } = await sm.send(new GetSecretValueCommand({ SecretId: "payments/db" }));
const db = JSON.parse(SecretString);
console.log(db.user, db.host, db.port);

Expected output:

pay_app db.internal 5432

3. PHP: read it and build a PDO DSN.

<?php
require "vendor/autoload.php";
$sm = new Aws\SecretsManager\SecretsManagerClient(["region" => "sa-east-1"]);
$db = json_decode($sm->getSecretValue(["SecretId" => "payments/db"])["SecretString"], true);
$dsn = "pgsql:host={$db["host"]};port={$db["port"]};dbname=payments";
echo $dsn, PHP_EOL;

Expected output:

pgsql:host=db.internal;port=5432;dbname=payments

4. Verify: describe the secret (never prints the value).

aws secretsmanager describe-secret --secret-id payments/db --region sa-east-1 --query "[Name,LastChangedDate]" --output text

Expected output:

payments/db  2026-10-24T12:10:00+05:30

3. Update and rotate

Why do we need this?

The security team in Chennai rotates every database password each 30 days.

What is it?

PutSecretValue writes a new version labelled AWSCURRENT; the old one becomes AWSPREVIOUS. RotateSecret runs a rotation Lambda on a schedule.

How to do it (step by step)

1. Python: generate and store a new password.

pw = sm.get_random_password(PasswordLength=24, ExcludePunctuation=True)["RandomPassword"]
cur = json.loads(sm.get_secret_value(SecretId="payments/db")["SecretString"])
cur["password"] = pw
v = sm.put_secret_value(SecretId="payments/db", SecretString=json.dumps(cur))
print(v["VersionStages"])

Expected output:

['AWSCURRENT']

2. Node.js: turn on automatic rotation.

import { RotateSecretCommand } from "@aws-sdk/client-secrets-manager";
await sm.send(new RotateSecretCommand({
  SecretId: "payments/db",
  RotationLambdaARN: "arn:aws:lambda:sa-east-1:123456789012:function:pg-rotator",
  RotationRules: { ScheduleExpression: "rate(30 days)" },
}));
console.log("rotation on");

Expected output:

rotation on

3. PHP: read the previous version (for a rollback).

<?php
$old = $sm->getSecretValue(["SecretId" => "payments/db", "VersionStage" => "AWSPREVIOUS"]);
echo json_decode($old["SecretString"])->user, " previous version ok", PHP_EOL;

Expected output:

pay_app previous version ok

4. Verify: list versions.

aws secretsmanager list-secret-version-ids --secret-id payments/db --region sa-east-1 --query "Versions[].VersionStages" --output text

Expected output:

AWSPREVIOUS
AWSCURRENT

4. Parameter Store settings

Why do we need this?

Sneha keeps feature flags, the UPI gateway URL and a Stripe key per environment.

What is it?

Name parameters as paths like /payments/prod/... . String for plain values, SecureString for secrets. GetParametersByPath reads the whole tree (10 per page, paginate).

How to do it (step by step)

1. Python: put three parameters.

ssm = boto3.client("ssm", region_name="ap-south-2")
ssm.put_parameter(Name="/payments/prod/upi_url", Value="https://upi.example.in/v2", Type="String", Overwrite=True)
ssm.put_parameter(Name="/payments/prod/max_txn_inr", Value="200000", Type="String", Overwrite=True)
ssm.put_parameter(Name="/payments/prod/stripe_key", Value="sk_live_51abc", Type="SecureString", Overwrite=True)
print("3 saved")

Expected output:

3 saved

2. Node.js: read one SecureString.

import { SSMClient, GetParameterCommand } from "@aws-sdk/client-ssm";
const ssm = new SSMClient({ region: "ap-south-2" });
const r = await ssm.send(new GetParameterCommand({ Name: "/payments/prod/stripe_key", WithDecryption: true }));
console.log(r.Parameter.Type, r.Parameter.Value.slice(0, 8) + "…");

Expected output:

SecureString sk_live_…

3. PHP: read the whole path with a paginator.

<?php
$ssm = new Aws\Ssm\SsmClient(["region" => "ap-south-2"]);
$cfg = [];
foreach ($ssm->getPaginator("GetParametersByPath", ["Path" => "/payments/prod/", "WithDecryption" => true]) as $page)
    foreach ($page["Parameters"] as $p) $cfg[basename($p["Name"])] = $p["Value"];
ksort($cfg); echo implode(",", array_keys($cfg)), PHP_EOL;

Expected output:

max_txn_inr,stripe_key,upi_url

4. Verify: describe parameters.

aws ssm describe-parameters --parameter-filters Key=Path,Values=/payments/prod --region ap-south-2 --query "Parameters[].[Name,Type]" --output text

Expected output:

/payments/prod/max_txn_inr  String
/payments/prod/stripe_key   SecureString
/payments/prod/upi_url      String

5. Cache values

Why do we need this?

At 500 requests a second, calling AWS every time is slow, costly and hits throttling.

What is it?

Read once and keep it in memory for a few minutes. Python and others have official caching libraries; a small TTL cache works everywhere. On Lambda, the Parameters and Secrets extension does it for you on localhost:2773.

How to do it (step by step)

1. Python: official cache.

# pip install aws-secretsmanager-caching
from aws_secretsmanager_caching import SecretCache, SecretCacheConfig
cache = SecretCache(config=SecretCacheConfig(secret_refresh_interval=300), client=sm)
for _ in range(3):
    print(json.loads(cache.get_secret_string("payments/db"))["user"])

Expected output:

pay_app
pay_app
pay_app   (one API call)

2. Node.js: a tiny TTL cache.

const cache = new Map();
async function param(name, ttl = 300_000) {
  const hit = cache.get(name);
  if (hit && hit.exp > Date.now()) return hit.v;
  const r = await ssm.send(new GetParameterCommand({ Name: name, WithDecryption: true }));
  cache.set(name, { v: r.Parameter.Value, exp: Date.now() + ttl });
  return r.Parameter.Value;
}
console.log(await param("/payments/prod/max_txn_inr"), await param("/payments/prod/max_txn_inr"));

Expected output:

200000 200000   (second read from memory)

3. PHP: APCu cache around the SDK call.

<?php
function param(Aws\Ssm\SsmClient $ssm, string $n): string {
    $v = apcu_fetch($n, $ok);
    if ($ok) return $v;
    $v = $ssm->getParameter(["Name" => $n, "WithDecryption" => true])["Parameter"]["Value"];
    apcu_store($n, $v, 300);
    return $v;
}
echo param($ssm, "/payments/prod/upi_url"), PHP_EOL;

Expected output:

https://upi.example.in/v2

4. Verify: on Lambda, read via the extension.

curl -s -H "X-Aws-Parameters-Secrets-Token: $AWS_SESSION_TOKEN" "localhost:2773/systemsmanager/parameters/get?name=/payments/prod/upi_url" | jq -r .Parameter.Value

Expected output:

https://upi.example.in/v2

6. The same call in Java, Go, .NET and the CLI

Why do we need this?

Teams often mix languages. Once you know the call in Python, PHP and Node.js, the other SDKs are the same API with different syntax.

What is it?

All of them call the GetSecretValue API. Use the CLI line to test it quickly from a terminal.

How to do it (step by step)

7. Clean up so nothing keeps costing

Why do we need this?

Lab resources left running cost money and can be a security risk.

What is it?

Delete in reverse order: children first, then parents.

How to do it (step by step)

1. Delete the secret and parameters.

aws secretsmanager delete-secret --secret-id payments/db --force-delete-without-recovery --region sa-east-1
aws ssm delete-parameters --names /payments/prod/upi_url /payments/prod/max_txn_inr /payments/prod/stripe_key --region ap-south-2

Expected output:

(no output means success)

8. Interview questions and answers

Revision, comparison and interview cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

More cards: Ravi Sir's Cards.