Testing and Deployment · Topic 2 of 6
Environment Configuration and API Stages
Manage per environment settings with AppConfig, Parameter Store, Secrets Manager and Lambda aliases, and use API Gateway stages and stage variables.
- 5 min
- Parameter Store is hierarchical, and SecureString values use KMS.
- Secrets Manager provides built in automatic rotation, and Parameter Store does not.
- AppConfig adds validators, deployment strategies and alarm based rollback to configuration changes.
What it is
The same build should run in development, test and production. Only the configuration changes: database endpoints, feature switches, API keys and log levels. Keeping configuration outside the code is what lets one artifact move through every environment.
AWS gives you several places to hold that configuration, and several ways to represent an environment itself, such as an API Gateway stage or a Lambda alias.
How it works
Choosing where configuration lives
| Service | Use it for | Key feature |
|---|---|---|
| Lambda environment variables | Simple settings read at startup | Per function version, 4 KB total |
| Systems Manager Parameter Store | Plain and encrypted settings in a hierarchy | SecureString values encrypted with KMS |
| Secrets Manager | Database credentials and API keys | Automatic rotation with a Lambda function |
| AWS AppConfig | Settings and feature flags that change at run time | Validation, gradual rollout, automatic rollback |
Parameter Store names can form a path, such as /shop/prod/db_url and /shop/dev/db_url. The code reads the path for its own environment with GetParameter, or reads a whole branch with GetParametersByPath. For a SecureString you ask for decryption, and the caller needs permission on the KMS key as well.
Secrets Manager stores a secret as a versioned value and can rotate it on a schedule. Choose it when the question mentions rotating credentials, and Parameter Store when it asks for cheap, simple configuration.
AppConfig deploys configuration without redeploying code. You define an application, an environment and a configuration profile, then roll out a new version with a deployment strategy that shifts it gradually. A validator (a JSON Schema or a Lambda function) rejects bad configuration, and a CloudWatch alarm can roll the deployment back automatically. Feature flags are a profile type. Lambda functions typically fetch AppConfig data through the AppConfig Lambda extension, which caches it locally.
Environment variables on a published Lambda version are frozen. Only $LATEST can be edited, so different values per environment mean different versions or separate functions.
API Gateway stages and stage variables
A stage is a named snapshot of an API deployment, such as dev or prod. For a REST API, you must create a deployment and assign it to a stage before a change is live. Each stage has its own invoke URL: https://{api-id}.execute-api.{region}.amazonaws.com/{stage}.
Stage level settings include throttling, caching, logging and an optional canary that sends a percentage of traffic to a new deployment. Stage variables act like environment variables for the stage and are referenced as ${stageVariables.name}.
A classic use is pointing a stage at a Lambda alias, for example an integration URI ending in :${stageVariables.lambdaAlias}. The function then needs a resource based permission that allows API Gateway to invoke that alias.
REST API endpoint types are Edge optimized (through CloudFront), Regional and Private (only from a VPC through an interface endpoint). A custom domain name with a base path mapping can point api.example.com/v1 at a particular API and stage.
HTTP APIs also use stages. They have a default stage named $default that is served without a stage name in the URL, and they can deploy automatically.
Representing environments
| Platform | Environment is represented by |
|---|---|
| Lambda | Aliases such as dev and prod, pointing to function versions |
| Container images | Tags such as a build number or prod |
| API Gateway | Stages |
| AWS Amplify | One deployed branch per environment, each with its own URL |
| AWS Copilot | Environments created with the Copilot CLI for ECS based services |
A Lambda alias is a pointer to a version. It can also split traffic by weight between two versions. Clients keep using the alias ARN while you move it to a new version.
How the exam asks about this
- "The same API must call the test function in test and the production function in production." -> Use a stage variable for the Lambda alias in the integration.
- "Settings must change without redeploying, with gradual rollout and rollback." -> AWS AppConfig.
- "A database password must be rotated automatically." -> AWS Secrets Manager.
What to remember for the exam
- Parameter Store is hierarchical, and SecureString values use KMS.
- Secrets Manager provides built in automatic rotation, and Parameter Store does not.
- AppConfig adds validators, deployment strategies and alarm based rollback to configuration changes.
- A REST API change is not live until you deploy it to a stage.
- Stage variables are referenced as
${stageVariables.name}, and Lambda needs a permission for each alias API Gateway calls. - A Lambda alias gives one stable ARN for an environment and supports weighted traffic shifting between two versions.
Environment variables are visible to anyone who can read the function configuration. Store only a reference such as a parameter name, and fetch the secret value at run time.
Common mistakes
Forgetting to redeploy a REST API. Editing resources and methods changes only the working copy until you deploy to the stage.
Using Secrets Manager for every setting. Plain configuration fits Parameter Store, and runtime changes with safe rollout fit AppConfig.
Pointing a stage variable at an alias without the permission. The call then fails with an invocation error until API Gateway is allowed to invoke that alias.
Check yourself
Which service rolls out a configuration change gradually and rolls back on an alarm?
AWS AppConfig.
How can one REST API use different Lambda functions per stage?
Reference a stage variable for the alias or function name in the integration, and grant API Gateway invoke permission.
What makes a Lambda alias useful for environments?
It is a stable ARN that points to a version and can split traffic between two versions.
Topic 2 of 6 in Testing and Deployment
Test yourself on Testing and Deployment
The full AWS DVA-C03 question bank has 850 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.