AWS Secrets Manager
- What it is
- Stores, retrieves, and automatically rotates secrets: database credentials, API keys, OAuth tokens.
- Encrypted with AWS Key Management Service (KMS); access controlled by IAM; every retrieval logged to CloudTrail.
- The differentiator: rotation
- Built-in rotation for Amazon RDS, Amazon Aurora, Redshift, and DocumentDB, or a custom Lambda for anything else.
- Applications fetch the current secret at runtime, so nothing is hardcoded in source.
- Not to be confused with
- AWS Systems Manager Parameter Store — also stores config values and SecureStrings, and is free for standard parameters, but has no built-in rotation and no cross-Region replication of secrets. See AWS Systems Manager.
- The one-line rule
- Needs automatic rotation → Secrets Manager. Just configuration, cost matters → Parameter Store.