Storing Credentials in Secrets Manager

Database passwords and API keys hardcoded in code or config files are a top breach cause. They leak through repos, logs, and backups.

AWS Secrets Manager stores secrets securely, controls access with IAM, and can rotate them automatically, so secrets never live in your code.

Secrets Manager stores, encrypts, retrieves, and rotates secrets such as database credentials and API keys.

• Secrets are encrypted at rest with KMS.
• Apps fetch them at runtime via an API call instead of embedding them.

Each secret is encrypted with a KMS key and guarded by IAM and an optional resource-based policy.

You grant only the specific roles that need a secret access to it, and every retrieval is logged in CloudTrail, giving full accountability.

The standout feature is automatic rotation.

• A Lambda function changes the secret on a schedule and updates the store.
• Built-in rotation supports RDS and other databases.

Rotation limits the damage window if a credential is ever exposed.

For databases, rotation typically uses two sets of credentials or an alternating-user strategy so applications never see an invalid password during the change.

The Lambda creates a new secret value, tests it, then promotes it, all without downtime when configured correctly.

Applications call GetSecretValue to fetch a secret when needed, often caching it briefly.

Because the app holds an IAM role, no static credentials are needed to retrieve the secret, completing the chain of removing long-term keys from code.

SSM Parameter Store also stores configuration and secrets (SecureString) and is free for standard parameters.

• Choose Secrets Manager for built-in automatic rotation and cross-account secret sharing.
• Choose Parameter Store for simpler, cost-free config without rotation.

Secrets Manager supports a resource policy to share a secret with another account and can replicate secrets to other regions.

This serves multi-region apps and disaster recovery, keeping a consistent secret available where the workload runs.

Monitor secret usage with CloudTrail (who retrieved or rotated a secret) and detect anomalies.

For example, GuardDuty can flag unusual access patterns, and Config rules can check that rotation is enabled, keeping secret hygiene measurable.

Many AWS services consume Secrets Manager secrets natively.

• RDS and Redshift can store and manage their master credentials there.
• ECS, Lambda, and CodeBuild can inject secrets at runtime.

This means workloads receive credentials securely without your code ever embedding or fetching them manually.

To use secrets safely:

• Never hardcode secrets; fetch from Secrets Manager.
• Enable rotation and use a dedicated KMS key.
• Grant least-privilege access per secret and audit retrievals.

Choose the right service.

You learned about Secrets Manager.

• It stores, encrypts (with KMS), and rotates secrets automatically.
• Apps fetch secrets at runtime via IAM-controlled API calls, never hardcoding them.
• Choose it over Parameter Store when you need rotation or cross-account sharing.