# Creating a Parameter Store parameter using Tools for Windows PowerShell
You can use AWS Tools for Windows PowerShell to create `String`, `StringList`, and `SecureString` parameter types. After deleting a parameter, wait for at least 30 seconds to create a parameter with the same name.
Parameters can't be referenced or nested in the values of other parameters. You can't include `{{}}` or `{{ssm:{{parameter-name}}}}` in a parameter value.
**Note**
Parameters are only available in the AWS Region where they were created.
**Topics**
+ [Creating a String parameter (Tools for Windows PowerShell)](#param-create-ps-string)
+ [Creating a StringList parameter (Tools for Windows PowerShell)](#param-create-ps-stringlist)
+ [Creating a SecureString parameter (Tools for Windows PowerShell)](#param-create-ps-securestring)
## Creating a String parameter (Tools for Windows PowerShell)
1. Install and configure the AWS Tools for PowerShell (Tools for Windows PowerShell), if you haven't already.
For information, see [Installing the AWS Tools for PowerShell](https://docs.aws.amazon.com/powershell/latest/userguide/pstools-getting-set-up.html).
1. Run the following command to create a parameter that contains a plain text value. Replace each {{example resource placeholder}} with your own information.
```
Write-SSMParameter `
-Name "{{parameter-name}}" `
-Value "{{parameter-value}}" `
-Type "String"
```
-or-
Run the following command to create a parameter that contains an Amazon Machine Image (AMI) ID as the parameter value.
**Note**
To create a parameter with a tag, first create an `Amazon.SimpleSystemsManagement.Model.Tag` object as a variable. The following is an example.
```
$tag = New-Object Amazon.SimpleSystemsManagement.Model.Tag
$tag.Key = "tag-key"
$tag.Value = "tag-value"
```
```
Write-SSMParameter `
-Name "{{parameter-name}}" `
-Value "{{an-AMI-id}}" `
-Type "String" `
-DataType "aws:ec2:image" `
-Tags $tag
```
The `-DataType` parameter specifies how Parameter Store validates the parameter value. For example, use `aws:ec2:image` to validate an AMI ID or `integer` to validate an integer value. If you don't specify a data type, the default is `text`, which performs no validation. For the full list of supported data types, see [Parameter data types in Parameter Store](parameter-store-data-types.md). For more information about the `aws:ec2:image` data type, see [Using native parameter support in Parameter Store for Amazon Machine Image IDs](parameter-store-ec2-aliases.md).
Here is an example that uses a parameter hierarchy.
```
Write-SSMParameter `
-Name "/IAD/Web/SQL/IPaddress" `
-Value "99.99.99.999" `
-Type "String" `
-Tags $tag
```
1. Run the following command to verify the details of the parameter.
```
(Get-SSMParameterValue -Name "{{the-parameter-name-you-specified}}").Parameters
```
## Creating a StringList parameter (Tools for Windows PowerShell)
1. Install and configure the AWS Tools for PowerShell (Tools for Windows PowerShell), if you haven't already.
For information, see [Installing the AWS Tools for PowerShell](https://docs.aws.amazon.com/powershell/latest/userguide/pstools-getting-set-up.html).
1. Run the following command to create a StringList parameter. Replace each {{example resource placeholder}} with your own information.
**Note**
To create a parameter with a tag, first create an `Amazon.SimpleSystemsManagement.Model.Tag` object as a variable. The following is an example.
```
$tag = New-Object Amazon.SimpleSystemsManagement.Model.Tag
$tag.Key = "tag-key"
$tag.Value = "tag-value"
```
```
Write-SSMParameter `
-Name "{{parameter-name}}" `
-Value "{{a-comma-separated-list-of-values}}" `
-Type "StringList" `
-Tags $tag
```
If successful, the command returns the version number of the parameter.
Here is an example.
```
Write-SSMParameter `
-Name "stringlist-parameter" `
-Value "Milana,Mariana,Mark,Miguel" `
-Type "StringList" `
-Tags $tag
```
**Note**
Items in a `StringList` must be separated by a comma (,). You can't use other punctuation or special characters to escape items in the list. If you have a parameter value that requires a comma, then use the `String` type.
1. Run the following command to verify the details of the parameter.
```
(Get-SSMParameterValue -Name "{{the-parameter-name-you-specified}}").Parameters
```
## Creating a SecureString parameter (Tools for Windows PowerShell)
Before you create a `SecureString` parameter, read about the requirements for this type of parameter. For more information, see [Creating a SecureString parameter using the AWS CLI](param-create-cli.md#param-create-cli-securestring).
Only the *value* of a `SecureString` parameter is encrypted. Parameter names, descriptions, and other properties aren't encrypted.
**Important**
Parameter Store only supports [symmetric encryption KMS keys](https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-choose-key-spec.html#symmetric-cmks). You can't use an [asymmetric encryption KMS key](https://docs.aws.amazon.com/kms/latest/developerguide/symmetric-asymmetric.html) to encrypt your parameters. For help determining whether a KMS key is symmetric or asymmetric, see [Identifying symmetric and asymmetric KMS keys](https://docs.aws.amazon.com/kms/latest/developerguide/find-symm-asymm.html) in the *AWS Key Management Service Developer Guide*
1. Install and configure the AWS Tools for PowerShell (Tools for Windows PowerShell), if you haven't already.
For information, see [Installing the AWS Tools for PowerShell](https://docs.aws.amazon.com/powershell/latest/userguide/pstools-getting-set-up.html).
1. Run the following command to create a parameter. Replace each {{example resource placeholder}} with your own information.
**Note**
To create a parameter with a tag, first create an `Amazon.SimpleSystemsManagement.Model.Tag` object as a variable. The following is an example.
```
$tag = New-Object Amazon.SimpleSystemsManagement.Model.Tag
$tag.Key = "tag-key"
$tag.Value = "tag-value"
```
```
Write-SSMParameter `
-Name "{{parameter-name}}" `
-Value "{{parameter-value}}" `
-Type "SecureString" `
-KeyId "{{an AWS KMS key ID, an AWS KMS key ARN, an alias name, or an alias ARN}}" `
-Tags $tag
```
If successful, the command returns the version number of the parameter.
**Note**
To use the AWS managed key assigned to your account, remove the `-KeyId` parameter from the command.
The following example creates a `SecureString` parameter named `/myapp/dev/vendor/merchant-id` with a merchant ID as the encrypted value and an AWS managed key.
```
Write-SSMParameter `
-Name "/myapp/dev/vendor/merchant-id" `
-Value "merchant-739482" `
-Type "SecureString"`
-Tags $tag
```
1. Run the following command to verify the details of the parameter.
```
(Get-SSMParameterValue -Name "{{the-parameter-name-you-specified}}" –WithDecryption $true).Parameters
```
By default, all `SecureString` values are displayed as cipher-text. To decrypt a `SecureString` value, a user must have permission to call the AWS KMS [Decrypt](https://docs.aws.amazon.com/kms/latest/APIReference/API_Decrypt.html) API operation. For information about configuring AWS KMS access control, see [Authentication and Access Control for AWS KMS](https://docs.aws.amazon.com/kms/latest/developerguide/control-access.html) in the *AWS Key Management Service Developer Guide*.
**Important**
If you change the KMS key alias for the KMS key used to encrypt a parameter, then you must also update the key alias the parameter uses to reference AWS KMS. This only applies to the KMS key alias; the key ID that an alias attaches to stays the same unless you delete the whole key.