AWS Secrets Manager

A service for securely managing API keys and passwords.

Back to glossary Go to related practice questions

In one sentence

A service for securely managing API keys and passwords.

Overview

A service that securely stores secrets such as DB passwords and API keys, with rotation support.

Common use cases

Storing DB credentials
Managing external API keys
Automatic secret rotation

CLF-C02 exam points

A secret management service
Provides rotation functionality
Often compared with Parameter Store on exams

SAA-C03 exam points

Used for designs where Lambda retrieves secrets at runtime
Integrates with KMS for encryption
Understand which databases support rotation

Practical Use

AWS Secrets Manager is a managed service for securely storing, retrieving, and rotating secrets such as database credentials, API keys, OAuth tokens, and other secret information. Secrets are encrypted at rest using AWS KMS, and retrieval permissions can be controlled at a fine granularity through IAM policies. Application code retrieves secrets through the AWS SDK by calling an API (GetSecretValue), eliminating the need to write them in plaintext within code, environment variables, or configuration files. A major feature is automatic rotation. For Amazon RDS, Amazon Redshift, Amazon DocumentDB, and Amazon ElastiCache, AWS provides Lambda function templates for rotation that can update secrets automatically on a defined schedule once configured. For arbitrary secrets, similar automatic rotation can be implemented by writing a custom rotation Lambda function. Version management of secrets is built in, so older versions remain referenceable for a period during rotation. Typical use cases include retrieving RDS connection passwords from Lambda functions or ECS tasks, securely storing API keys for external SaaS integration, and centrally managing credentials used in CI/CD pipelines. Pricing is composed of a monthly fixed fee per secret and the number of API calls. Compared to AWS Systems Manager Parameter Store, Parameter Store has a free Standard tier but lacks automatic rotation, while Secrets Manager is positioned as a paid service that includes rotation. From SAA-C03 onward, the choice between Parameter Store and Secrets Manager is a frequent topic.

Official Documentation

Cost notes

Billed by number of secrets and API calls
Do not use it in the MVP if no external secrets exist

Security notes

Do not hardcode secrets in environment variables or Git
Restrict retrieval permission to the target Lambda only

Related services

AWS Key Management Service

Service that manages data encryption keys on AWS.

AWS Systems Manager

A service that consolidates operational management of AWS environments and servers.

AWS Lambda

Runs code only when needed, without launching servers.

Related architecture diagrams

Related architecture diagrams have not been added for this term yet.