Secrets Manager and Parameter Store

A common and dangerous anti-pattern is storing secrets (database passwords, API keys, OAuth tokens) in application source code, environment variables, or configuration files checked into version control. When these repositories are exposed — accidentally made public, or accessed by an attacker — all secrets are compromised immediately. AWS provides two managed services to eliminate this problem: AWS Secrets Manager for credentials that need automatic rotation, and AWS Systems Manager Parameter Store for configuration values and non-rotating secrets.

AWS Secrets Manager is a managed service for storing, retrieving, and automatically rotating secrets. It encrypts all secrets with KMS (by default using an AWS managed key, or your CMK). Secrets can store any structured data as a key-value JSON string. Secrets Manager charges $0.40/secret/month plus $0.05 per 10,000 API calls. Key differentiator from Parameter Store: built-in automatic rotation for RDS, Redshift, DocumentDB, and custom secrets via Lambda rotation functions — no application changes needed during rotation.

Automatic rotation is Secrets Manager's most powerful feature. For RDS databases, Secrets Manager natively rotates passwords by: 1) Generating a new password. 2) Updating the database user's password in RDS. 3) Updating the secret with the new password. 4) Verifying the new credentials work. All of this happens while your application is running — zero downtime, no manual intervention. Applications always call get-secret-value to retrieve the current password, so they automatically use the rotated credentials.

Calling Secrets Manager on every database query would be expensive and slow. Best practice is to cache the secret locally in memory for a short period. AWS provides official Secrets Manager caching clients for Java and Python that cache secrets for a configurable TTL. When the cache expires, the client re-fetches the secret from Secrets Manager. If an application receives an authentication error (indicating the password was rotated), it immediately refreshes the cache and retries. This pattern provides performance and freshness without hammering the Secrets Manager API.

AWS Systems Manager (SSM) Parameter Store is a free (for standard parameters) hierarchical key-value store for configuration data and secrets. It supports String, StringList, and SecureString parameter types. SecureString encrypts values with KMS. Unlike Secrets Manager, Parameter Store does NOT support automatic rotation — it is designed for configuration values that change infrequently. Standard parameters are free and can store up to 4 KB. Advanced parameters support larger values (up to 8 KB), parameter policies (expiration and rotation reminders), and cost $0.05/parameter/month.

Organise Parameter Store values using a hierarchical path structure that mirrors your environment and application architecture. This allows fine-grained IAM policies that grant access to parameters by path prefix. For example, grant a Lambda function access only to parameters under /prod/payment-service/ — it cannot access other services' parameters. This principle of least privilege for configuration prevents one compromised service from reading another service's secrets.

Choose between the two services based on your requirements: Use Secrets Manager when: you need automatic secret rotation, you are storing database credentials, the secret must be shared across multiple AWS accounts, or compliance requires documented rotation policies. Use Parameter Store when: you need configuration values (non-secret), you want a free solution for simple key-value storage, you need hierarchical configuration with path-based access control, or you need to store parameter version history. Many architectures use both together: Parameter Store for config, Secrets Manager for credentials.

Lambda functions and ECS tasks should retrieve secrets at startup, not at every invocation. For Lambda: retrieve secrets in the initialisation code (outside the handler function) and cache in global variables — the Lambda execution environment persists between invocations, so secrets are only fetched once per environment lifetime. For ECS: use the secrets field in the task definition to inject Secrets Manager values or Parameter Store SecureStrings as environment variables — ECS retrieves and injects them at task launch without any application code changes.

A practical but often overlooked use of Parameter Store is storing AMI IDs and other deployment references. Instead of hardcoding AMI IDs in your CloudFormation templates (which become stale when new AMIs are released), reference a Parameter Store value. Your CI/CD pipeline updates the AMI ID in Parameter Store whenever a new golden AMI is built. CloudFormation reads the latest AMI ID from Parameter Store at deploy time. AWS also publishes the latest Amazon Linux AMI IDs in public Parameter Store paths that you can reference directly.

Secrets governance requires knowing who accessed secrets and when. AWS CloudTrail records every API call to Secrets Manager and Parameter Store: GetSecretValue, PutParameter, GetParameter. This gives you a complete audit trail for compliance. Use CloudWatch Alarms on CloudTrail metrics to alert when secrets are accessed outside normal patterns — for example, if a production secret is accessed from an unusual IAM principal or from an IP not in your known range, fire an alert for investigation.

In multi-account architectures, applications in one account sometimes need secrets managed in another account (e.g., a central Security account manages all RDS passwords). Secrets Manager resource policies allow cross-account access. Configure a resource-based policy on the secret that grants a role in the consuming account permission to call GetSecretValue. The consuming account role must also have an IAM policy allowing calls to the secret's ARN. KMS key policies must also grant the consuming account access to the CMK used to encrypt the secret.

Test your understanding of AWS Solutions Architect (SAA-C03) concepts from this lesson.

In this lesson you learned: Secrets Manager provides automatic rotation for database credentials and API keys, and is the preferred choice for secrets that must rotate, Parameter Store provides free hierarchical configuration storage with path-based IAM access control, and ECS and Lambda can inject secrets as environment variables without application code changes. CloudTrail provides audit trails for all secret access. Next up we explore WAF, Shield, and Network Firewall.