AWS Secrets Manager
Storing, retrieving, and rotating secrets: database credentials, API keys, and tokens retrieved at runtime instead of hard-coded, managed rotation and rotation with Lambda functions, encryption with KMS, resource policies for cross-account access, multi-Region replication, integrations with RDS and other services, and how it compares with Parameter Store.
4 min read · Last reviewed · SAA-C03
Loading your progress
Sign in to bookmark tutorials and track what you have read.
On this page
What it is
AWS Secrets Manager helps you manage, retrieve, and rotate database credentials, application credentials, OAuth tokens, API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry keys, and other secrets throughout their lifecycles. Instead of hard-coding credentials in source code or configuration, applications retrieve secrets at runtime with a call to Secrets Manager, and you can rotate them on a schedule so that long-term secrets become short-term ones.
Choose Secrets Manager when a question asks to remove hard-coded database passwords, rotate credentials automatically, or share secrets securely across accounts or AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry.
Concepts
- Secret: a secret value (often a JSON (JavaScript Object Notation)A text format for structured data made of name-and-value pairs and lists, such as {"bucket": "logs"}. IAM policies, most AWS API responses, and many CloudFormation templates are written in JSON.Glossary entry document of user name and password) plus metadata, encrypted with a KMS key, either the AWS managed key
aws/secretsmanageror a Customer managed keyA KMS key that you create, own, and manage: you control its key policy, rotation, and deletion. AWS managed keys, in contrast, are created and managed for you by an AWS service.Glossary entry. Secrets Manager uses Envelope encryptionEncrypting data with a data key, then encrypting that data key with another key, such as a KMS key, and storing the encrypted data key with the data. Large data never has to be sent to AWS KMS, only the small data key.Glossary entry. - Rotation:
- Managed rotation: for most managed secrets (secrets that AWS services create for you), the service configures and manages rotation, with no Lambda function.
- Rotation by Lambda function: for other secrets, such as RDS, Aurora, Redshift, and DocumentDB credentials you manage, a Lambda function updates the secret and the database together on a schedule.
- Managed external secrets: for secrets held by Secrets Manager partners.
- Integrations: many services store or read secrets in Secrets Manager:
- RDS and Aurora can manage the master password in Secrets Manager.
- CloudFormation dynamic references read secrets at deploy time.
- ECS and EKS can inject secrets into containers.
- Resource-based policyA permissions policy attached to a resource, such as an S3 bucket policy or an SQS queue policy, that says which principals can use it, including principals in other accounts. Identity-based policies, in contrast, attach to users, groups, and roles.Glossary entry: grant access to a secret to several users and roles, including PrincipalA person or workload that can make requests to AWS, such as an IAM user, a role session, the root user, a federated user, or an AWS service. Resource-based policies name the principals they allow.Glossary entry in other AWS accounts. Cross-account access also needs a customer managed KMS key that the other account may use, because the AWS managed key
aws/secretsmanagercan't be used across accounts. - Multi-Region replication: replicate secrets to other Regions for multi-Region applications and DR (Disaster recovery)Preparing for and recovering from events that take a workload down, such as a Regional outage or deleted data. AWS describes four strategies, from cheapest and slowest to costliest and fastest: backup and restore, pilot light, warm standby, and multi-site active/active.Glossary entry, and promote a replica to a standalone secret if needed.
Security, resilience, performance, and cost
Security
- Control access with IAM and resource policies, encrypt with KMS, and audit with CloudTrail. Rotation limits how long a leaked secret stays useful.
Resilience
- Replicate secrets to other Regions; rotation keeps credentials in sync with the database.
Performance
- Cache secrets in the application with AWS's client-side caching libraries to reduce calls and LatencyThe time between sending a request and receiving the response, usually measured in milliseconds. Distance and processing add to it; caching and serving users from nearby locations reduce it.Glossary entry.
Cost
- Pay per secret per month (a replica counts as a separate secret) and per 10,000 API calls.
Secrets Manager or Parameter Store?
| AWS Secrets Manager | Systems Manager Parameter Store | |
|---|---|---|
| Built for | Secrets: database credentials, API keys, tokens | Configuration data and simple secrets (SecureString) |
| Automatic rotation | Yes (managed or with Lambda) | No |
| Cross-Region replication | Yes | No |
| Cross-account sharing | Resource-based policies | Advanced parameters can be shared |
| Cost | Per secret per month plus API calls | Standard parameters have no charge |
Reverse mindmap: when the question points here
- Yes, when the question says
- Remove hard-coded database passwords leads to Secrets Manager
- Rotate RDS credentials automatically leads to Secrets Manager rotation
- API keys retrieved at runtime leads to Secrets Manager
- Choose the feature
- Rotation without custom code leads to Managed rotation
- Custom secret type to rotate leads to Rotation Lambda function
- Another account reads the secret leads to Resource policy and customer managed KMS key
- Same secret in another Region leads to Multi-Region replication
- Secret in a CloudFormation template leads to Dynamic reference
- No, when the question says
- Plain configuration values, no rotation, lowest cost leads to Parameter Store
- Encryption keys leads to KMS
Key takeaways
- Secrets Manager stores secrets encrypted with KMS and lets applications retrieve them at runtime instead of hard-coding them.
- Rotation is managed for most managed secrets, or uses a Lambda function for others, such as database credentials.
- Resource policies (with a customer managed KMS key) allow cross-account access; secrets can be replicated across Regions.
- Use Secrets Manager when rotation is needed; Parameter Store suits configuration and simple secrets.
- Pay per secret per month and per 10,000 API calls.
Sources
- AWS Secrets Manager User Guide: What is AWS Secrets Manager?
- AWS Secrets Manager User Guide: Create a secret
- AWS Secrets Manager User Guide: Get secrets
- AWS Secrets Manager User Guide: Rotate secrets
- AWS Secrets Manager User Guide: Secret encryption and decryption
- AWS Secrets Manager User Guide: Resource-based policies
- AWS Secrets Manager User Guide: Access secrets from a different account
- AWS Secrets Manager User Guide: Get a secret value using Java with client-side caching
- Amazon ECS Developer Guide: Pass Secrets Manager secrets through environment variables
- AWS Secrets Manager User Guide: AWS Secrets and Configuration Provider CSI for EKS
- AWS Secrets Manager User Guide: Replicate secrets across Regions
- AWS Secrets Manager User Guide: AWS services that use Secrets Manager secrets
- AWS Secrets Manager User Guide: Get a secret in a CloudFormation resource
- AWS Systems Manager User Guide: Parameter Store
- AWS Secrets Manager pricing