AWS Secrets Manager
Managed secrets storage — automatic rotation, RDS integration, cross-account sharing, and comparison with SSM Parameter Store.
Overview
AWS Secrets Manager is a managed service for storing, retrieving, and automatically rotating secrets — database credentials, API keys, OAuth tokens, and other sensitive data.
Secrets Manager integrates natively with Amazon RDS, Redshift, and DocumentDB for automatic credential rotation without application downtime. All secrets are encrypted with KMS.
Core Concepts
| Concept | Description |
|---|---|
| Secret | A stored value (string or binary) containing credentials or other sensitive data |
| Secret Version | Each rotation creates a new version; supports staging labels (AWSCURRENT, AWSPREVIOUS) |
| Rotation | Automatic periodic update of a secret's value using a Lambda function |
| Rotation Lambda | A Lambda function that generates new credentials and updates the target service |
| Staging Label | Tags identifying the current, previous, and pending versions of a secret |
| Resource Policy | Controls cross-account access to a secret (similar to S3 bucket policies) |
How Rotation Works
1. Secrets Manager invokes rotation Lambda (createSecret)
2. Lambda generates new credentials on the target (e.g., RDS)
3. Lambda stores new credentials as AWSPENDING version
4. Lambda tests the new credentials (testSecret)
5. Lambda promotes AWSPENDING → AWSCURRENT (finishSecret)
6. Previous AWSCURRENT → AWSPREVIOUS- Rotation interval: configurable (e.g., every 30, 60, or 90 days)
- RDS, Redshift, DocumentDB: AWS provides pre-built rotation Lambda templates
- Custom secrets: write a custom Lambda function
SAA/SAP Tip: For "automatically rotate database credentials," the answer is Secrets Manager — not SSM Parameter Store. Only Secrets Manager provides built-in rotation with Lambda integration.
Secrets Manager vs SSM Parameter Store
| Feature | Secrets Manager | SSM Parameter Store |
|---|---|---|
| Primary purpose | Secrets with rotation | Configuration and secrets (no rotation) |
| Automatic rotation | Yes (built-in Lambda integration) | No (manual rotation via Lambda possible) |
| RDS integration | Native rotation templates | No built-in integration |
| Cross-account sharing | Yes (resource policy) | No native cross-account support |
| Encryption | Always encrypted (KMS required) | Optional (SecureString uses KMS) |
| Cost | $0.40/secret/month + $0.05 per 10K calls | Free (standard) / $0.05 per 10K advanced |
| Max value size | 64 KB | 4 KB (standard) / 8 KB (advanced) |
| Versioning | Automatic with staging labels | Label-based (manual) |
Exam Trap: SSM Parameter Store SecureString parameters can store secrets, but they lack automatic rotation and native RDS integration. When the question mentions "rotation," always choose Secrets Manager.
Common Use Cases
- Database credentials — Store and rotate RDS/Aurora/Redshift passwords automatically.
- API keys — Centrally manage third-party API keys with encryption and access control.
- Cross-account secret sharing — Resource policies allow other accounts to retrieve secrets without copying them.
- Application configuration — Store sensitive config values retrieved via SDK at runtime.
- CI/CD pipelines — Inject credentials into CodeBuild or Lambda without hardcoding.
SAA/SAP Exam Tips
SAA/SAP Tip: For "store and rotate database credentials with minimal operational effort," the answer is Secrets Manager with native RDS rotation. No custom Lambda is needed for supported databases (RDS, Redshift, DocumentDB).
Exam Trap: Secrets Manager charges per secret per month ($0.40). For application configurations that are not sensitive (e.g., feature flags, endpoint URLs), use SSM Parameter Store (free tier available) instead.
Cross-Cloud Equivalents
| Provider | Service / Solution | Notes |
|---|---|---|
| AWS | AWS Secrets Manager | Baseline |
| Azure | Azure Key Vault (Secrets) | Combined key + secret management |
| GCP | Google Secret Manager | Similar API-based secret storage |
| On-Premises | HashiCorp Vault, CyberArk | Enterprise secrets management platforms |
Pricing Model
| Dimension | Unit | Notes |
|---|---|---|
| Secret storage | $0.40/secret/month | Billed per secret regardless of size |
| API calls | $0.05 per 10,000 | GetSecretValue, PutSecretValue, etc. |
| Rotation | Lambda pricing | Standard Lambda invocation costs apply |
Related Services / See Also
- AWS KMS and CloudHSM — encryption keys used to protect secrets
- AWS IAM — controls who can access and manage secrets
- Amazon RDS and Aurora — native credential rotation target
- AWS Systems Manager Parameter Store — alternative for non-rotating configurations
AWS Organizations
Multi-account management — Organizational Units, Service Control Policies, consolidated billing, and AWS Control Tower for governance at scale.
AWS WAF and Shield
Web application firewall and DDoS protection — web ACLs, rate limiting, managed rules, Shield Standard vs Advanced.