What is the difference between environment variables and AWS Systems Manager (SSM) Parameter Store for Lambda configuration?

Both environment variables and the AWS Systems Manager (SSM) Parameter Store can be used to manage configuration values for Lambda functions. However, they serve different purposes and have distinct capabilities when it comes to security, scalability, and best practices.

Environment Variables

1
Key-value pairs set directly in the Lambda configuration
2
Available at runtime via process.env in Node.js or os.environ in Python
3
Supports encryption using AWS KMS for sensitive data
4
Limited to 4 KB in total size per function
5
Ideal for non-sensitive, short-lived, environment-specific settings

AWS SSM Parameter Store

1
Centralized service for managing configuration data and secrets
2
Supports both plain-text and encrypted (SecureString) parameters
3
Accessible via AWS SDK (e.g., Boto3, AWS SDK for JS)
4
Allows versioning, auditing, and fine-grained access control
5
Better suited for storing shared, sensitive, or dynamic values

Fetching a Secure Parameter in Python (Boto3)

Difficulty: 5/10

Topics: Lambda configuration, SSM Parameter Store, environment variables

Scenario Questions

0-2 years experience

1
How would you store a database connection string for a Lambda function that needs to be changed without redeploying the code?
2
If you set an environment variable in the Lambda console and also a parameter in SSM with the same name, which one does the function see at runtime?
3
What happens if you try to reference an SSM SecureString parameter directly as an environment variable without using the Lambda console integration?

2-5 years experience

1
You notice that after rotating a secret in Parameter Store, your Lambda still uses the old value. Walk me through how you would debug this issue.
2
When deciding between using Lambda environment variables versus SSM Parameter Store for configuration, what trade‑offs do you consider regarding security, versioning, and deployment speed?
3
Suppose you need to pass a large JSON config to a Lambda, but environment variables have size limits. How would you handle this using SSM?

5-8 years experience

1
Design a pattern for managing per‑environment (dev, staging, prod) configuration for hundreds of Lambdas using SSM Parameter Store. How would you handle naming, permissions, and rollout without downtime?
2
At scale, fetching parameters from SSM on each invocation can add latency. Explain how you would mitigate this while keeping secrets secure.
3
If a compliance audit requires all secrets to be encrypted with a customer‑managed CMK, how does that affect your choice between environment variables and SSM, and what changes would you make to the Lambda deployment pipeline?

8+ years experience

1
Your organization is migrating legacy Lambdas that currently embed credentials in environment variables to a centralized Parameter Store approach. Outline a migration strategy that minimizes risk, ensures auditability, and supports multiple teams.
2
Consider a multi‑region, multi‑account architecture where the same Lambda code runs everywhere but needs region‑specific config. How would you design the configuration management using SSM and environment variables to balance consistency and flexibility?
3
From a long‑term operational perspective, what governance processes would you put in place to manage lifecycle (creation, rotation, deprecation) of parameters versus environment variables across dozens of services?

Follow-up Questions

❓How do you control which Lambda functions can read a given SSM parameter?
❓What monitoring would you put in place to detect stale or out‑of‑sync configuration?
❓Can you walk through how you would test a migration from env vars to Parameter Store before going live?