AWS Secrets Manager
Managed storage, rotation, and audited retrieval of credentials — the antidote to passwords in environment variables and API keys in Git.
What is AWS Secrets Manager?
Secrets Manager stores sensitive values — database passwords, API keys, tokens — encrypted with KMS, retrieved at runtime via IAM-authorized API calls, with every access logged to CloudTrail. Its headline feature over plain encrypted storage is automatic rotation: for supported databases, it runs a Lambda that generates a new password, updates the database, and updates the secret — closing the window that static credentials leave open, without human involvement.
The problem it actually solves
Credentials leak through the mundane: .env files committed to Git, passwords baked into container images (extractable from any layer forever), keys pasted into CI configs, secrets in Terraform state. Secrets Manager moves the credential out of all those artifacts — code references a secret name, resolves it at runtime with the running role’s permissions, and the actual value lives in exactly one audited place. Rotate it there, and every consumer picks up the new value on next fetch.
Choosing among the options
Secrets Manager vs SSM Parameter Store: Parameter Store (SecureString) is cheaper and fine for config and low-churn secrets; Secrets Manager’s premium (~$0.40/secret/month + API calls) buys native rotation and cross-region replication — pay it where rotation matters. Vault (HashiCorp) is the multi-cloud/on-prem alternative with dynamic short-lived secrets as its signature. The universal disciplines regardless of tool: cache fetched secrets briefly (per-call retrieval adds latency and cost), scope IAM so each service reads only its own secrets, and never log resolved values — a secret printed into logs is a secret in every log sink.
What people get wrong
- Fetching on every request instead of caching with a short TTL — latency and API-cost tax.
- Storing secrets but still echoing them into logs, error messages, or debug output.
- Over-broad read permissions: one role that can read every secret recreates the blast radius the tool was meant to shrink.
Primary source: AWS Secrets Manager documentation
Historical figures and technical concepts for informational purposes only. Not technical, professional, legal, or financial advice. Sources: Official Documentation.