AWS Secrets Manager

AWS Secrets Manager is a service that helps you protect access to your applications, services, and IT resources by enabling you to rotate, manage, and retrieve secrets throughout their lifecycle. A 'secret' can be database credentials, on-premises resource credentials, API keys, SSH keys, or any other sensitive information that you need to keep confidential.

The core problem Secrets Manager solves is the insecure practice of hardcoding secrets in application code, configuration files, or environment variables. Hardcoded secrets are vulnerable to exposure through source code repositories, logs, or debugging tools. Additionally, rotating secrets manually is error-prone and can lead to application downtime if not coordinated properly. Secrets Manager provides a centralized, auditable, and automated way to manage secrets with built-in encryption and rotation capabilities.

Secrets Manager stores secrets as encrypted blobs. When you create a secret, you provide the plaintext secret value (or Secrets Manager can generate a random password for you). Secrets Manager encrypts the secret using AWS Key Management Service (KMS) with a customer master key (CMK) that you can either let Secrets Manager create (the default aws/secretsmanager key) or use your own customer-managed CMK. The encrypted secret is stored in multiple Availability Zones for durability.

To retrieve a secret, your application calls the GetSecretValue API. The request must be authenticated and authorized via IAM policies. Secrets Manager decrypts the secret using the KMS key and returns the plaintext value over a TLS-protected connection. The secret is never logged or stored in plaintext in any AWS service.

Secrets Manager also supports automatic rotation of secrets for supported AWS database services (Amazon RDS for MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, and Amazon Aurora, Amazon Redshift, Amazon DocumentDB, and Amazon EMR). You can also configure rotation for any service by providing a custom Lambda function. Rotation works by creating a new version of the secret (with a staging label like 'AWSCURRENT' or 'AWSPENDING') and updating the target resource accordingly. The rotation process is designed to avoid downtime by temporarily using both old and new credentials during the transition.

Secrets Manager has a simple pricing model: you pay per secret stored per month and per 10,000 API calls. As of 2025, the price is $0.40 per secret per month (for the first 100,000 secrets) and $0.05 per 10,000 API calls. There is no additional charge for using the default KMS key, but if you use a customer-managed CMK, you pay KMS key usage fees ($1 per key per month plus $0.03 per 10,000 requests).

Secrets Manager offers two tiers: Standard and Advanced. Standard secrets support automatic rotation for RDS and other services, but they do not support cross-Region replication. Advanced secrets (previously known as Secrets Manager for AWS Organizations) support cross-Region replication and are billed at a higher rate ($1.00 per secret per month). Most exam scenarios use Standard secrets.

In an on-premises environment, secrets might be stored in a vault like HashiCorp Vault, CyberArk, or even in plaintext configuration files. On-premises solutions require managing the infrastructure, high availability, backup, and access control manually. Secrets Manager is fully managed, meaning AWS handles the infrastructure, encryption, rotation, and scaling. It also integrates natively with other AWS services like IAM, CloudTrail (for auditing), and KMS.

Compared to AWS Systems Manager Parameter Store, Secrets Manager is designed specifically for secrets with automatic rotation and encryption at rest by default. Parameter Store can also store secure strings (encrypted with KMS), but it lacks automatic rotation, versioning for secrets (it has versioning for parameters, but not the same staging labels), and cross-Region replication for standard parameters. Parameter Store is cheaper ($0.05 per parameter per month for standard tier, free for advanced tier but with additional costs) and is better suited for configuration data that is not necessarily secret (e.g., AMI IDs, endpoint URLs).

Use Secrets Manager when you need:

Use Parameter Store when you need:

For the CLF-C02 exam, the key distinction is that Secrets Manager is the preferred service for storing secrets that require rotation, while Parameter Store is a general-purpose configuration store that can also store secrets but without rotation.

A mid-sized e-commerce company runs a web application on EC2 instances with an RDS MySQL database. Initially, developers hardcoded the database password in the application's configuration file, which was stored in a Git repository. After a security audit, they migrated to AWS Secrets Manager. They created a secret for the database credentials, enabled automatic rotation every 30 days, and assigned an IAM role to the EC2 instances with permissions to retrieve the secret. The application code was modified to call GetSecretValue at startup and cache the password in memory. This eliminated the risk of credential exposure in source code. Cost: $0.40 per month for the secret plus API call costs (~$0.05 per 10,000 calls). The team also set up CloudTrail logging to monitor any retrieval of the secret. A common mistake they initially made was forgetting to add kms:Decrypt permission to the IAM role, causing the application to fail with an access denied error. The exam often tests that both Secrets Manager and KMS permissions are required.

A SaaS company integrates with a third-party payment gateway that requires an API key. The key is long-lived and must be rotated manually every 90 days. The company uses Secrets Manager to store the API key and a custom Lambda function to rotate it. The Lambda function calls the payment gateway's API to generate a new key, then updates the secret in Secrets Manager. The rotation schedule is set to 90 days. The application retrieves the current secret using the AWSCURRENT version. During rotation, the Lambda creates a new version with AWSPENDING, updates the gateway, tests the new key, and then promotes it to AWSCURRENT. The old key is retained as AWSPREVIOUS for rollback. This automation reduced operational overhead and eliminated the risk of expired keys causing downtime. Cost: $0.40/month for the secret plus Lambda execution costs (negligible). The exam may ask about using custom Lambda functions for rotation for non-RDS secrets.

A financial services company has a primary application in us-east-1 and a disaster recovery site in us-west-2. They use an Advanced secret (cross-Region replication) to replicate database credentials from us-east-1 to us-west-2. When a failover occurs, the application in us-west-2 retrieves the same secret from the local replica. This ensures that credentials are available without latency or dependency on the primary region. The replicated secret is read-only in the target region; any updates (e.g., rotation) happen in the primary region and are automatically propagated. The exam may test that cross-Region replication is only available with Advanced secrets (higher cost) and that replicated secrets are read-only in the target region.