Feature flags for the portal can be ordinary configuration, but thi…

Question

Feature flags for the portal can be ordinary configuration, but third-party API tokens must not sit in plaintext parameters. How should Parameter Store / Secrets Manager usage be matched to sensitivity?

Accepted Answer

Keep non-sensitive feature flags as plaintext parameters; store API tokens as SecureString or in Secrets Manager — Feature flags are sticky notes; API tokens are the safe combination. Plaintext parameters are fine for the notes — tokens get SecureString or Secrets Manager.

Answer

Store API tokens as plaintext String parameters and feature flags as Secrets Manager secrets for symmetry

Answer

Put both feature flags and API tokens in the same public S3 config object readable by

Answer

Use only plaintext env vars for tokens so Lambda cold starts avoid KMS Decrypt latency

Feature flags for the portal can be ordinary configuration, but third-party API tokens must not sit in plaintext parameters. How should Parameter Store / Secrets Manager usage be matched to sensitivity?

Short Explanation

Full Explanation