Parameters can be encrypted with KMS We can have heirarchy with / version tracking of values? In advanced tier, you can setup expiration time in cli usage, pass -with-decryption to get the encryped parameter in plain text