Key Management, Secrets Manager, and Parameter Store

In any computer system, you have information that must be kept secret, like a password for a database or a cryptographic key used to encrypt customer data. AWS offers three primary services to store and manage this sensitive information, each designed for a different job. Understanding the difference between them is critical for the SCS-C02 exam.

First, let's define 'Key Management' using AWS Key Management Service (KMS). AWS KMS is a managed service that lets you create and control encryption keys. An encryption key is a string of random characters used to scramble (encrypt) data so it becomes unreadable, and to unscramble (decrypt) it back to its original form. KMS does not store your data. It stores the keys that protect your data. You tell KMS 'create a key', and it gives you a reference to that key. When your application wants to encrypt data, it sends the data to KMS, KMS uses your key to encrypt it, and returns the encrypted version. You never see the plaintext of the encryption key itself. This is called 'envelope encryption', where a master key (in KMS) encrypts a data key that encrypts your actual data.

Second, AWS Secrets Manager is a service specifically for managing passwords, API keys, and other 'secrets'. An API key is a code used to identify a program or user calling an API (Application Programming Interface—a way for two programs to talk to each other). A database password is a secret word that allows a user or program to access a database. Secrets Manager securely stores these secrets and automatically rotates (changes) them on a schedule you define. For example, you can tell Secrets Manager to change a database password every 30 days, and it will update the password in the database and in the application's configuration automatically. This 'rotation' is the key feature that distinguishes Secrets Manager from Parameter Store. Secrets Manager has a higher cost per secret than Parameter Store.

Third, AWS Systems Manager Parameter Store is a service for storing configuration data and secrets. Configuration data includes things like database connection strings, URLs, or environment settings. A connection string includes the database address and sometimes a username. Parameter Store is a hierarchy of key-value pairs. For example, you can store a parameter called "/myapp/database/url" with a value of "mydatabase.example.com". You can then reference this parameter from other AWS services. Parameter Store has two tiers: Standard (free) and Advanced (small fee). Standard parameters have a 4KB size limit, while Advanced allows up to 8KB. Parameter Store supports storing plain text or encrypted values using KMS. It does not have automatic rotation built in; if you want to rotate a password stored in Parameter Store, you must call AWS Lambda yourself to change it.

Here are the main differences in a quick overview:

Why do these services exist? In the past, developers often hard-coded secrets directly into application code or configuration files. This was insecure because anyone who could read the code (or a backup) could find the password. If the password changed, every place it was used had to be manually updated. These AWS services solve this by providing a central, secure, and auditable place to store and manage secrets and keys. The security team can control who has access to each secret using IAM policies.

For the SCS-C02, you must remember the specific use cases for each. The exam loves to ask: 'When would you use Secrets Manager versus Parameter Store?' The answer often hinges on whether automatic rotation is needed. If a company needs to rotate its database password monthly, Secrets Manager is the correct answer. If a company needs to store a static application version number, Parameter Store is correct. For encryption key management, KMS is always the answer.

An IT professional at a mid-sized e-commerce company named 'ShopFast' is tasked with securing their application. They have a web server, a database, and a third-party payment processing service. The web server needs to connect to the database using a username and password. It also needs to call an API to process credit card payments, which requires an API key. Additionally, all customer data (including payment details) must be encrypted at rest in the database.

Step 1: The IT professional decides to use AWS KMS to create a master key. They go to the KMS console and create a new symmetric customer-managed key. They name it 'ShopFastDataKey'. This key will be used to encrypt the database and any S3 buckets. The KMS key's ID (a unique identifier) is used in the database encryption settings.

Step 2: For the database password, the IT professional chooses AWS Secrets Manager. They create a secret called 'ShopFastDBPassword'. They set the 'rotation' option to every 30 days. Secrets Manager automatically generates a strong password, stores it, and then updates the database's master user password. It also updates the application's configuration to use the new password. This automates a process that used to be manual and error-prone.

Step 3: For the payment processing API key, the IT professional initially considers Secrets Manager but realises that the API key is provided by the payment processor and cannot be automatically rotated by AWS (the payment processor controls the key). So they choose Parameter Store and store it as a secure string encrypted with KMS. They set a parameter "/shopfest/payments/api-key" with the encrypted value. They will manually update this parameter if the payment processor changes the key.

Step 4: For other configuration data, like the database hostname and port, they also use Parameter Store as plain text parameters. This way, the application reads all its configuration from a central place. They use IAM roles to grant the web server's EC2 instance permission to access only the specific parameters and the specific KMS key.

Step 5: The IT professional sets up CloudTrail (AWS's audit logging service) to log all API calls to KMS, Secrets Manager, and Parameter Store. This creates an audit trail: if someone tries to decrypt data, the action is logged. This satisfies compliance requirements like PCI DSS (Payment Card Industry Data Security Standard).

The daily reality for this professional includes checking CloudTrail logs for unusual 'Decrypt' requests, verifying that Secrets Manager rotated the database password successfully, and managing KMS key policies to ensure only the necessary services can use the key. They must also keep the 'Key Management Service (KMS) key ID' safe—if it's deleted, all data encrypted with it becomes permanently unreadable.