Parameter Manager is the central store for workload configuration parameters in Google Cloud. The service is an extension to Secret Manager and complements its focus on secrets with management of general configuration data.
What is Parameter Manager?
Parameters are variables - often in the form of key-value pairs - that customize how an application functions. The documentation gives examples such as configuration settings including database connection strings, API keys, and user interface preferences; environment-specific settings tailored for production, development, or testing; and secrets such as credentials and secure connection strings.
With Parameter Manager you store all workload parameters in a centralized system, which simplifies management, improves consistency, and reduces errors. Using the same parameter values across environments supports consistent deployments, changes can be tracked for compliance and security purposes, and access is controlled through fine-grained IAM permissions.
The documented key features are encryption of parameters using the Advanced Encryption Standard (AES-256), versioning with the ability to roll back to previous values, flexible format support for YAML and JSON as well as unformatted configuration, the ability to reference Secret Manager secrets from parameters, and regional parameters through regional endpoints.
Structurally there are two resources: the parameter as a parent object holding metadata such as name, data type, and labels, and the parameter version, which stores the actual value. Each version can hold up to 1 MiB. The documentation additionally describes parameter templates, CMEK, audit logging, notifications via Pub/Sub, the Secret Manager add-on for GKE, and an integration with the Agent Development Kit.
The distinction from Secret Manager is clearly stated: Secret Manager is the right choice when the data is a secret; Parameter Manager targets configuration data that applications fetch dynamically at runtime without restarts or redeployments.
Core Features
- Central store: All configuration parameters of a workload in one place.
- Versioning: Multiple versions per parameter with rollback to previous values.
- Flexible formats: YAML, JSON, and unformatted configurations such as plain text or custom formats.
- Secret references: Inclusion of Secret Manager secrets including rotation and auditing.
- Regional parameters: Regional endpoints for location-specific management.
- Encryption: AES-256 plus customer-managed keys through CMEK.
- Traceability: Audit logging and notifications via Pub/Sub.
Typical Use Cases
Configuration across multiple environments
A team maintains settings for production, development, and test in one system and thereby ensures consistent deployments.
Feature flags without redeployment
An application reads feature flags at runtime from Parameter Manager so changes take effect without a restart.
Combining configuration with secrets
A parameter holds the complete application configuration and references the corresponding secrets in Secret Manager for credentials.
Traceable changes for audits
Changes to configuration values are documented through versions and audit logs and can be evidenced during reviews.
Regional storage of configuration
For environments with regional requirements, parameters are managed at the respective location through regional endpoints.
Benefits
- One system for configuration: Fewer scattered configuration files and environment variables.
- Clear separation from secrets: Secrets stay in Secret Manager but remain referenceable.
- Changes stay traceable: Versioning, audit logging, and notifications.
- Fine-grained permissions: Access through IAM instead of file permissions.
- Regional control: Regional endpoints for location-specific parameters.
Integration with innFactory
As a certified Google Cloud Partner, innFactory supports you with Parameter Manager: structuring your configuration, drawing the line between secrets and parameters, IAM and audit concepts, and integration into existing deployment processes and GKE environments.
Contact us for a consultation on Parameter Manager and Google Cloud.
Typical Use Cases
Technical Specifications
Frequently Asked Questions
What is Parameter Manager?
According to the documentation, Parameter Manager is an extension to the Secret Manager service and provides centralized storage for all configuration parameters related to your workload deployments. Parameters are variables, often in the form of key-value pairs, which customize how an application functions.
How does Parameter Manager differ from Secret Manager?
Secret Manager stores and manages sensitive data such as API keys, passwords, OAuth tokens, and TLS/SSL certificates, and is the right choice when the data is a secret. Parameter Manager stores and manages workload configuration data such as environment-specific settings and feature flags, and suits applications that dynamically fetch configuration at runtime without requiring restarts or redeployments.
Which formats does Parameter Manager support?
Configuration data can be stored in structured formats such as YAML and JSON. Unformatted configurations such as plain text or custom formats are also supported. Each parameter version can store up to 1 MiB.
Can I use secrets inside parameters?
Yes. According to the documentation, you can reference secrets stored in Secret Manager from Parameter Manager parameters. This lets you manage all application configuration data including secrets from Parameter Manager while still using Secret Manager features such as automatic rotation and auditing.
How are changes made traceable?
Each parameter can have multiple versions, so changes can be tracked over time and rolled back to previous values if needed. The documentation additionally describes audit logging and notifications via Pub/Sub.
Can parameters be stored regionally?
Yes. Parameter Manager supports regional endpoints, letting you create and manage parameters specific to each location. The list of locations that support regional endpoints is in the official documentation.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of Google Cloud (official documentation). This page does not represent an offer by Google Cloud.
