Yes using AllowReadingSSMParameters and eventually the KMS key to encrypt/decrypt the parameter