How to Load a Prompt From AWS SSM Parameter Store
A prompt hardcoded in Python means every wording tweak is a PR, a CI run, and a redeploy. Move the template into AWS SSM Parameter Store and read it at boot with boto3 get_parameter - now a one-line put-parameter updates the prompt with no code change. Here is how to do it.
Why hardcoded prompts slow you down
A summarizer service that keeps its prompt in the source is easy to write and painful to iterate:
PROMPT_TEMPLATE = "Summarize this text in one sentence:\n{text}"
Prompts are the part of an AI feature you change most - "make it two sentences," "use a formal tone," "add a length cap." With the template baked into the code, every one of those tweaks is a code change, a pull request, a CI run, and a redeploy. That build-deploy cycle kills the fast try-a-tweak-see-if-it-improves loop that makes AI features good.
Prompts are config, not code. AWS SSM Parameter Store is the baseline place to keep that config: a plain key/value store, free for standard parameters, and reachable from any service with an IAM role.
Read the prompt from SSM at boot
Store the template at a versioned key like /prompts/summarizer/v1, then fetch
it once when the module loads. boto3 reads the parameter with a single
get_parameter call and pulls the string out of the response payload:
import os
import boto3
def _load_prompt() -> str:
ssm = boto3.client(
"ssm",
endpoint_url=os.environ.get("AWS_ENDPOINT_URL"),
region_name=os.environ.get("AWS_DEFAULT_REGION", "us-east-1"),
)
return ssm.get_parameter(Name="/prompts/summarizer/v1")["Parameter"]["Value"]
PROMPT_TEMPLATE = _load_prompt()
def render_prompt(text: str) -> str:
return PROMPT_TEMPLATE.format(text=text)
The value comes back nested: get_parameter returns a dict with a Parameter
object, and the string you want is ["Parameter"]["Value"]. Loading it at module
import time means the round trip to SSM happens once per process, not on every
request.
Seed and update the parameter
Write the template with put-parameter. Use --type String for a plain prompt
(SecureString if it ever holds a secret):
aws ssm put-parameter \
--name /prompts/summarizer/v1 \
--value "Summarize the following in two sentences, formal tone:\n{text}" \
--type String
Read it back to confirm what the service will load:
aws ssm get-parameter --name /prompts/summarizer/v1
Now iterating on the prompt is a single command. To roll out "two sentences,
formal tone," you run put-parameter --overwrite and restart (or re-fetch) the
service - no PR, no CI, no image build. Verify end to end by running the service
and checking the rendered output:
python3 summarizer.py
Versioning and next steps
The v1 suffix in the key name is a cheap version scheme: publish
/prompts/summarizer/v2, point the service at it, and you can roll back by
flipping one env var. SSM also keeps a parameter history automatically, so you
can see prior values.
This is the baseline. Production prompt-config systems - LangSmith, Helicone, PromptLayer - version prompts, A/B test them, and link each version to eval results. SSM Parameter Store gets you the core win, decoupling prompts from deploys, with tooling you already have in AWS.
Want to try it hands-on? HeyDevJob gives you this exact setup in a live cloud workspace in your browser - edit it, run it, and see it work. Free, nothing to install.
Try it in a workspace →What you'll practice
- Fetching a parameter with boto3 ssm.get_parameter and reading Parameter.Value
- Seeding and updating a template with aws ssm put-parameter --type String
- Versioning prompts with a keyed path like /prompts/summarizer/v1 for rollback
FAQ
How do I load a value from AWS SSM Parameter Store in Python?
Create an SSM client with boto3.client("ssm") and call get_parameter(Name="/your/key"). The value is nested in the response as ["Parameter"]["Value"]. Fetch it once at module load so the round trip happens per process, not per request.
What is the difference between SSM Parameter Store String and SecureString?
A String parameter stores plain text, which is fine for a prompt template. A SecureString is KMS-encrypted at rest and is meant for secrets like API keys or passwords; retrieving it requires WithDecryption=True and the right KMS permissions.
How do I update an SSM parameter without a code redeploy?
Run aws ssm put-parameter --name /your/key --value "new value" --type String --overwrite. If your service reads the parameter at boot, restart it (or re-fetch on a schedule) to pick up the change - no code change, PR, or image build needed.
Why store LLM prompts in SSM instead of in the source code?
Prompts are config that gets iterated far more often than code. Keeping them in SSM turns each tweak into a one-line put-parameter instead of a full pull-request-CI-redeploy cycle, which preserves the fast experimentation loop AI features depend on.
Keep learning
Learn it by doing. Open this in a live cloud workspace, make the change yourself, and keep a record of the work you can share.
Open the workspace →