AWS Secrets Manager vs Parameter Store: storing application secrets safely

Two services

AWS Secrets Manager stores secrets encrypted with KMS, supports automatic rotation with Lambda functions (with ready-made rotation for RDS and other databases), cross-region replication, and resource policies. It is billed per secret per month plus API calls. SSM Parameter Store SecureString parameters are also KMS-encrypted and have a free standard tier, but no built-in rotation.

Use Secrets Manager for database credentials and anything that should rotate. Parameter Store suits configuration values and low-volume secrets where rotation is manual.

Least-privilege access

Grant an application role secretsmanager:GetSecretValue on one secret ARN, not on *. If the secret uses a customer managed KMS key, the role also needs kms:Decrypt on that key. Every retrieval is a CloudTrail event, so unusual access, such as a developer’s user reading a production secret, is visible.

Tag secrets with the owning application and environment, and use tag conditions in policies to keep environments separate.

Snippet

{
  "Effect": "Allow",
  "Action": "secretsmanager:GetSecretValue",
  "Resource": "arn:aws:secretsmanager:us-east-1:111122223333:secret:prod/orders/db-??????"
}

Lab: store, read, rotate

Create a secret for a sandbox RDS database, read it from an EC2 instance using its role, and enable rotation every 30 days with the managed rotation function. Trigger an immediate rotation and confirm the application still connects after fetching the new value.

Compare with a SecureString in Parameter Store, reading it with --with-decryption.

Snippet

aws secretsmanager create-secret --name prod/orders/db --secret-string '{"username":"orders","password":"CHANGE-ME"}'
aws secretsmanager get-secret-value --secret-id prod/orders/db --query SecretString --output text
aws secretsmanager rotate-secret --secret-id prod/orders/db --rotation-rules AutomaticallyAfterDays=30
aws ssm put-parameter --name /prod/orders/api-key --type SecureString --value 'example-value'
aws ssm get-parameter --name /prod/orders/api-key --with-decryption --query Parameter.Value --output text

Patterns to avoid

Secrets in source code, Docker images, Lambda environment variables visible in the console, CloudFormation parameters without NoEcho, and user data scripts. Each of those can be read by people or systems that should not see them.

Run a secret scanner on repositories and container images. When it finds something, rotate first and clean history second.

Diagram

Secrets Manager versus Parameter Store SecureString

Both encrypt with KMS.

Parameter Store SecureString

Rotation. Manual.

Cost. Free standard tier.

Fit. Config values and simple secrets.

Secrets Manager

Rotation. Built-in, including RDS.

Cost. Per secret and API call.

Fit. Database credentials and rotating secrets.

Check yourself

1. Which service offers built-in rotation for RDS credentials?

2. A role can call GetSecretValue but gets a KMS error. What is missing?

3. A scanner finds a database password in Git history. What first?