diff --git a/pass-core-main/pom.xml b/pass-core-main/pom.xml
index 4b6797d..034846d 100644
--- a/pass-core-main/pom.xml
+++ b/pass-core-main/pom.xml
@@ -160,6 +160,11 @@
       <artifactId>spring-security-saml2-service-provider</artifactId>
     </dependency>
 
+    <dependency>
+      <groupId>io.awspring.cloud</groupId>
+      <artifactId>spring-cloud-aws-starter-parameter-store</artifactId>
+    </dependency>
+
     <!-- Test dependencies -->
     <dependency>
       <groupId>org.springframework.boot</groupId>
diff --git a/pass-core-main/src/test/java/org/eclipse/pass/main/AwsParamStoreConfigTest.java b/pass-core-main/src/test/java/org/eclipse/pass/main/AwsParamStoreConfigTest.java
new file mode 100644
index 0000000..ebb725a
--- /dev/null
+++ b/pass-core-main/src/test/java/org/eclipse/pass/main/AwsParamStoreConfigTest.java
@@ -0,0 +1,86 @@
+/*
+ * Copyright 2024 Johns Hopkins University
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.eclipse.pass.main;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.testcontainers.containers.localstack.LocalStackContainer.Service.SSM;
+
+import java.io.IOException;
+
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.context.ConfigDataApplicationContextInitializer;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.core.env.Environment;
+import org.springframework.test.context.ContextConfiguration;
+import org.springframework.test.context.DynamicPropertyRegistry;
+import org.springframework.test.context.DynamicPropertySource;
+import org.testcontainers.containers.localstack.LocalStackContainer;
+import org.testcontainers.junit.jupiter.Container;
+import org.testcontainers.junit.jupiter.Testcontainers;
+import org.testcontainers.utility.DockerImageName;
+
+@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT,
+    properties = {
+        "spring.cloud.aws.credentials.access-key=noop",
+        "spring.cloud.aws.credentials.secret-key=noop",
+        "spring.cloud.aws.region.static=us-east-1"
+    })
+@ContextConfiguration(initializers = ConfigDataApplicationContextInitializer.class)
+@Testcontainers
+class AwsParamStoreConfigTest {
+    private static final DockerImageName LOCALSTACK_IMG =
+        DockerImageName.parse("localstack/localstack:3.1.0");
+
+    @Container
+    private static final LocalStackContainer localStack = new LocalStackContainer(LOCALSTACK_IMG).withServices(SSM);
+
+    @Autowired private Environment environment;
+
+    @DynamicPropertySource
+    static void properties(DynamicPropertyRegistry registry) {
+        registry.add("spring.cloud.aws.parameterstore.endpoint", () -> localStack.getEndpoint().toString());
+        registry.add("spring.cloud.aws.parameterstore.region", localStack::getRegion);
+        registry.add("spring.cloud.aws.endpoint", () -> localStack.getEndpoint().toString());
+        registry.add("spring.cloud.aws.region.static", localStack::getRegion);
+        registry.add("spring.config.import[0]", () -> "aws-parameterstore:/config/pass-core-client/");
+        registry.add("spring.config.import[1]", () -> "aws-parameterstore:/config/pass-core/");
+    }
+
+    @BeforeAll
+    static void beforeAll() throws IOException, InterruptedException {
+        localStack.execInContainer("awslocal", "ssm", "put-parameter",
+            "--name", "/config/pass-core-client/PASS_CORE_PASSWORD",
+            "--value", "aws-param-store-pw",
+            "--type", "SecureString");
+        localStack.execInContainer("awslocal", "ssm", "put-parameter",
+            "--name", "/config/pass-core/PASS_CORE_INSTN_CHG_LOG",
+            "--value", "test-chg-log",
+            "--type", "SecureString");
+    }
+
+    @Test
+    public void testLoadPropFromParamStore() {
+        String userNameProp = environment.getProperty("spring.security.user.name");
+        assertEquals("backend", userNameProp);
+        String userPwProp = environment.getProperty("spring.security.user.password");
+        assertEquals("aws-param-store-pw", userPwProp);
+        String changeLogProp = environment.getProperty("spring.liquibase.parameters.institution-changelog-file");
+        assertEquals("test-chg-log", changeLogProp);
+    }
+
+}
\ No newline at end of file
diff --git a/pom.xml b/pom.xml
index 518950f..d16e829 100644
--- a/pom.xml
+++ b/pom.xml
@@ -75,6 +75,7 @@
   <properties>
     <maven-dependency-plugin.version>3.6.1</maven-dependency-plugin.version>
     <spring-boot-maven-plugin.version>3.2.2</spring-boot-maven-plugin.version>
+    <awsspring.version>3.1.0</awsspring.version>
     <amazon.pom.version>2.25.16</amazon.pom.version>
     <elide.version>7.0.2</elide.version>
     <amazon.sqs.version>2.1.2</amazon.sqs.version>
@@ -143,6 +144,14 @@
         <scope>import</scope>
       </dependency>
 
+      <dependency>
+        <groupId>io.awspring.cloud</groupId>
+        <artifactId>spring-cloud-aws-dependencies</artifactId>
+        <version>${awsspring.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+
       <dependency>
         <groupId>software.amazon.awssdk</groupId>
         <artifactId>bom</artifactId>
@@ -247,6 +256,7 @@
                 <!-- These come from bundled jars -->
                 <ignoredDependency>org.springframework*::</ignoredDependency>
                 <ignoredDependency>software.amazon.awssdk::</ignoredDependency>
+                <ignoredDependency>io.awspring.cloud::</ignoredDependency>
               </ignoredDependencies>
               <ignoredUsedUndeclaredDependencies>
                 <!-- These come from elide starter -->