What is the difference between environment variables and AWS Systems Manager (SSM) Parameter Store for Lambda configuration?

0-2 years experience

1. 1How would you store a database connection string for a Lambda function that needs to be changed without redeploying the code?
2. 2If you set an environment variable in the Lambda console and also a parameter in SSM with the same name, which one does the function see at runtime?
3. 3What happens if you try to reference an SSM SecureString parameter directly as an environment variable without using the Lambda console integration?

2-5 years experience

1. 1You notice that after rotating a secret in Parameter Store, your Lambda still uses the old value. Walk me through how you would debug this issue.
2. 2When deciding between using Lambda environment variables versus SSM Parameter Store for configuration, what trade‑offs do you consider regarding security, versioning, and deployment speed?
3. 3Suppose you need to pass a large JSON config to a Lambda, but environment variables have size limits. How would you handle this using SSM?

5-8 years experience

1. 1Design a pattern for managing per‑environment (dev, staging, prod) configuration for hundreds of Lambdas using SSM Parameter Store. How would you handle naming, permissions, and rollout without downtime?
2. 2At scale, fetching parameters from SSM on each invocation can add latency. Explain how you would mitigate this while keeping secrets secure.
3. 3If a compliance audit requires all secrets to be encrypted with a customer‑managed CMK, how does that affect your choice between environment variables and SSM, and what changes would you make to the Lambda deployment pipeline?

8+ years experience

1. 1Your organization is migrating legacy Lambdas that currently embed credentials in environment variables to a centralized Parameter Store approach. Outline a migration strategy that minimizes risk, ensures auditability, and supports multiple teams.
2. 2Consider a multi‑region, multi‑account architecture where the same Lambda code runs everywhere but needs region‑specific config. How would you design the configuration management using SSM and environment variables to balance consistency and flexibility?
3. 3From a long‑term operational perspective, what governance processes would you put in place to manage lifecycle (creation, rotation, deprecation) of parameters versus environment variables across dozens of services?