AWS Secrets Manager
AWS Secrets Manager is an Amazon Web Services service that prevents secret credentials, such as database passwords, from being hardcoded in source code, making it possible to securely store and encrypt them with the least operational overhead.
AI Practitioner focus
- Store and rotate database passwords, API keys, OAuth client secrets, and other credentials used by AI applications or agent tools; retrieve them at runtime under an IAM role.
- Never place secrets in prompts, model context, source code, notebooks, or logs. KMS encrypts secret values, while Secrets Manager manages the secret lifecycle.
Key points
- Ensures in-transit encryption of the secret between AWS and the system retrieving it.
- Rotates credentials for AWS services using a Lambda function that instructs Secrets Manager to interact with the target service or database, on a schedule.
- Stores the encrypted secret value in the SecretString or SecretBinary field.
- Uses open-source client components to cache secrets and update them when rotation is needed.
- Accessible via the AWS Management Console, AWS Command Line Tools, AWS SDKs, and the HTTPS Query API.
- Rotates secrets safely without requiring code deployment, supporting security and compliance needs.
- Integrates with Amazon Cloudtrail and Amazon Cloudwatch to log and monitor for centralized auditing, and with Amazon Config to track configuration changes.
- Secret rotation is supported for the following databases: MySQL, PostgreSQL, Oracle, MariaDB, and Microsoft SQL Server on Amazon RDS; Amazon Aurora on Amazon RDS; Amazon DocumentDB; and Amazon Redshift.
- Encrypts secret values at rest using AWS Key Management Service (KMS) (the default AWS managed key
aws/secretsmanager, or a customer managed key); KMS itself only manages keys, it does not store or rotate the secrets. - Distinct from AWS Systems Manager Parameter Store: Secrets Manager is purpose-built for credentials, API keys, and database secrets, and provides native automatic rotation, at a cost of per secret per month plus API calls; Parameter Store is free (standard tier) or low-cost (advanced tier) and suits general configuration data or secrets that don’t require automatic rotation, but has no built-in rotation capability.