Load Django Settings From AWS SSM Parameter Store

Problem statement

Your Django app on AWS needs configuration and secrets per environment, and you want something simpler and cheaper than AWS Secrets Manager for values that do not need automatic rotation. SSM Parameter Store holds plain and encrypted (SecureString) parameters in a hierarchy, integrates with ECS task definitions, and standard parameters have no storage charge. The work is organizing paths, granting IAM access, and getting values into Django at startup.

1. Store parameters under a path per app and environment: /shop/prod/SECRET_KEY as SecureString.
2. On ECS, reference them in the task definition's secrets with valueFrom set to the parameter ARN.
3. On EC2, Lambda, or scripts, read the path with boto3 get_parameters_by_path(..., WithDecryption=True) at startup.
4. Grant ssm:GetParameters (and kms:Decrypt for custom keys) only on /shop/prod/*.
5. Use Secrets Manager instead for values that need automatic rotation, such as RDS passwords.

Step-by-step solution

1. Store parameters

aws ssm put-parameter --name /shop/prod/SECRET_KEY --type SecureString \
  --value "$(python -c 'import secrets; print(secrets.token_urlsafe(50))')"
aws ssm put-parameter --name /shop/prod/ALLOWED_HOSTS --type String --value "shop.example.com"
aws ssm put-parameter --name /shop/prod/DATABASE_URL --type SecureString --value "postgres://..."

SecureString parameters are encrypted with the AWS-managed aws/ssm key by default or a customer-managed KMS key. Using the setting name as the last path component makes loading into environment variables trivial.

2. Inject into ECS tasks

"containerDefinitions": [{
  "name": "web",
  "image": "123456789012.dkr.ecr.eu-central-1.amazonaws.com/shop:3f2a1c9",
  "secrets": [
    {"name": "SECRET_KEY", "valueFrom": "arn:aws:ssm:eu-central-1:123456789012:parameter/shop/prod/SECRET_KEY"},
    {"name": "DATABASE_URL", "valueFrom": "arn:aws:ssm:eu-central-1:123456789012:parameter/shop/prod/DATABASE_URL"}
  ]
}]

ECS fetches the values when starting the task, using the task execution role, and passes them as environment variables. Changes take effect for new tasks; force a new deployment after updating a parameter.

3. Read parameters on EC2, Lambda, or anywhere

Load a whole path into the environment before Django reads settings, for example in wsgi.py, manage.py, or a settings helper:

import os, boto3

def load_ssm_path(path="/shop/prod/"):
    ssm = boto3.client("ssm")
    paginator = ssm.get_paginator("get_parameters_by_path")
    for page in paginator.paginate(Path=path, WithDecryption=True, Recursive=False):
        for p in page["Parameters"]:
            os.environ.setdefault(p["Name"].rsplit("/", 1)[-1], p["Value"])

if os.environ.get("SSM_PATH"):
    load_ssm_path(os.environ["SSM_PATH"])

setdefault lets explicit environment variables override SSM values, which is handy for local testing. Credentials come from the instance profile or Lambda role.

4. Grant least privilege

{
  "Effect": "Allow",
  "Action": ["ssm:GetParameters", "ssm:GetParametersByPath"],
  "Resource": "arn:aws:ssm:eu-central-1:123456789012:parameter/shop/prod/*"
}

Add kms:Decrypt on the customer-managed key if you use one. Staging tasks get /shop/staging/* only, so a staging compromise cannot read production values.

5. Updates and auditing

Parameters keep a version history (aws ssm get-parameter-history). CloudTrail logs every read and change. Because values are read at start, roll ECS services or restart processes after changes. For SECRET_KEY rotation, use SECRET_KEY_FALLBACKS during the switch.

Explanation

Parameter Store is part of AWS Systems Manager: a key-value store with hierarchical names, optional KMS encryption, versions, and IAM-controlled access. ECS and Lambda can resolve parameters at start, and the SDK can read paths in bulk. For Django, the result is the same environment variables your settings already use, with values managed centrally and access scoped by path.

Edge cases / notes

• Throughput limits. Standard throughput is limited; avoid reading parameters per request. Read once per process.
• Large values. Standard parameters are limited to 4 KB; certificates or large JSON may need advanced parameters or S3.
• Cross-account. Sharing parameters across accounts is possible with advanced parameters and resource policies; plan it deliberately.

Next steps

• For rotating credentials, see Manage Django Secrets With AWS Secrets Manager.
• Wire it into ECS with Deploy Django on AWS ECS Fargate.
• If tasks fail to start pulling secrets, see Fix ECS Essential Container in Task Exited.

FAQ

Should I use Parameter Store or Secrets Manager?

Parameter Store for configuration and static secrets; Secrets Manager when you need managed rotation.

How do ECS tasks read parameters?

Through the task definition's secrets section, resolved by the task execution role at start.

Do running tasks see updated parameters?

No. Start new tasks with a new deployment after changing values.

Is Parameter Store free?

Standard parameters have no storage charge, and standard throughput API calls are free; check current AWS pricing for advanced parameters.