Managing secrets without a secrets-manager subscription

Using Pulumi and AWS SSM Parameter Store for a small team’s configuration workflow.

Parameter Store as the baseline

AWS Systems Manager Parameter Store provides encrypted parameters, IAM access control, and a familiar path for application configuration without adding another paid secrets product. Secrets and non-secret configuration can use the same naming convention while permissions distinguish who may read each value.

Review before apply

Infrastructure changes move through Pulumi preview and Pulumi up. Preview shows the proposed resource and policy changes before anything is applied; up makes the approved change. Lambda functions read parameters at runtime using their execution role, while Pulumi state lives in a remote S3 backend so the team can collaborate without committing state to the repository.

The important discipline is not the product name. It is keeping values out of source control, limiting IAM reads, auditing access, and making infrastructure changes reviewable.

Practical follow-up

Parameter names should encode environment and service without exposing the secret itself, for example /adroitpad/production/api/key. IAM policies can then grant a Lambda access to only the path it needs instead of the entire parameter store.

Rotation should be tested as an application behavior, not only an infrastructure change. Prefer short-lived runtime reads or a controlled refresh strategy, and make failures observable without logging the secret value.

Conclusion

The secure workflow is the combination of reviewable infrastructure, protected storage, and narrowly scoped runtime access. The diagram connects Pulumi changes to SSM Parameter Store and then to the Lambda execution environment. That flow keeps secret values out of source control and gives IAM a concrete boundary to enforce. Parameter names can identify environment and service without revealing contents. Rotation must be tested as application behavior, with observability that never logs the value itself. The product choice matters less than preserving this chain from approved change to least-privilege read.