Secrets Manager

Secrets Manager stores and manages sensitive values — database passwords, API keys, OAuth tokens, private certificates — and makes them available to your applications securely at runtime, without hardcoding them in source code or configuration files.

The Problem with Hardcoded Secrets

Database passwords and API keys embedded in application code or environment files have a way of ending up in version control, log files, or error messages. Once a secret is in Git history, it's effectively compromised — even if you delete it, it exists in the history forever.

Secrets Manager gives you a central, encrypted store for secrets. Your application code calls the Secrets Manager API at startup (or on demand) to retrieve the current value. The secret never touches your codebase, never appears in your deployment scripts, and can be rotated without touching your application at all.

Automatic Rotation

Secrets Manager's standout feature is automatic rotation. For supported databases (RDS, Redshift, DocumentDB), you enable rotation and configure a schedule. Secrets Manager generates a new password, updates it in the database, updates the secret value, and your application — which retrieves the secret on each connection — picks up the new password transparently.

For other secret types, you provide a Lambda function that performs the rotation logic. Secrets Manager calls it on schedule.

Accessing Secrets in Code

Retrieval is a single API call:

import boto3, json

client = boto3.client('secretsmanager')
secret = json.loads(
    client.get_secret_value(SecretId='prod/myapp/db')['SecretString']
)
password = secret['password']

The IAM role your application runs as needs permission to call secretsmanager:GetSecretValue on that specific secret. Everything else — encryption, decryption, version management — is handled by the service.

Secrets Manager vs SSM Parameter Store

Both can store secrets. Parameter Store is simpler and free for standard parameters. Secrets Manager costs more but adds automatic rotation, cross-region replication, and a richer API designed specifically for credentials. Use Parameter Store for non-sensitive configuration and simple secrets; use Secrets Manager when you need automatic rotation or a purpose-built credential store.