powertools-parameters

Powertools Parameters

Overview

@aws-lambda-powertools/parameters provides a single API for SSM Parameter Store, Secrets Manager, and AppConfig with built-in caching. Use it instead of manual SDK calls and cache Maps. Reduces latency and cost across invocations.

Dependencies

pnpm add @aws-lambda-powertools/parameters

Secrets Manager

// src/shared/secrets/index.ts

import { getSecret } from "@aws-lambda-powertools/parameters/secrets";
import { logger } from "@/shared/logger";

const CACHE_TTL_SECONDS = 300; // 5 minutes

export async function getDatabaseCredentials(): Promise<{
  username: string;
  password: string;
  host: string;
  port: number;
  database: string;
}> {
  const secretId = process.env.DATABASE_SECRET_ARN!;
  try {
    const value = await getSecret(secretId, {
      maxAge: CACHE_TTL_SECONDS,
      transform: "json",
    });
    return value as {
      username: string;
      password: string;
      host: string;
      port: number;
      database: string;
    };
  } catch (error) {
    logger.error({ err: error, secretId }, "Failed to retrieve secret");
    throw error;
  }
}

SSM Parameter Store

import { getParameter } from "@aws-lambda-powertools/parameters/ssm";

const opensearchEndpoint = await getParameter("/real-estate/opensearch-endpoint", {
  maxAge: 60,
});

const configJson = await getParameter("/real-estate/config", {
  maxAge: 120,
  transform: "json",
});

AppConfig (Feature Flags / Config)

import { getAppConfig } from "@aws-lambda-powertools/parameters/appconfig";

const config = await getAppConfig("my-app", "my-env", "my-config", {
  maxAge: 60,
});

Caching Behavior

• maxAge: Cache TTL in seconds. Same secret/parameter within the same Lambda instance returns cached value.
• Cache is per-instance; cold starts fetch fresh.
• Use shorter maxAge for frequently changing config; longer for secrets.

IAM and CDK

Grant the Lambda role access to the secret or parameter: