SSM Parameter with secret-like name should use SecureString type

What it checks

SSM parameter: name suggests it contains a secret, but type is not SecureString.

Where it applies

Terraform: aws_ssm_parameter

CloudFormation: AWS::SSM::Parameter

How to fix it

1. Create a new aws_ssm_parameter under a new name with type = "SecureString" (optionally key_id for a customer-managed KMS key), move every reader to the new name, then remove the plaintext parameter.
2. Do not rely on editing type in place: the Terraform AWS provider applies a type change as an in-place update that overwrites the managed parameter (its documentation names recreation only for an Advanced-to-Standard tier downgrade), not a destroy-and-recreate, and Parameter Store can reject a String-to-SecureString change (HierarchyTypeMismatchException: create a new, unique parameter).
3. Rotate the secret value, since it was stored as a plaintext String parameter.

Frameworks

• SOC 2 CC6.1
• HIPAA 164.312(a)(2)(iv)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules