AWS Secrets Manager
A locked vault for passwords and API keys, so they never live in your code.
AWS Secrets Manager stores the sensitive values an application needs: database passwords, API keys for third-party services, private keys, tokens. You save a secret under a name such as prod/payments/stripe-key, and your code asks for it by name at runtime through the AWS API, with IAM deciding who is allowed to read it. The value is encrypted at rest and never printed in logs.
The problem it attacks is secrets in the wrong place: inside source code, in a config file committed to Git, in an environment variable visible to anyone who can log in to the server. Once a password reaches a repository it is effectively public, even after you delete it. Secrets Manager also rotates secrets: for an Amazon RDS database it can change the password every 30 days on its own and update the stored value, so a leaked credential has a short life.
Example: an AWS Lambda function needs to connect to a database. Its IAM role allows secretsmanager:GetSecretValue on one specific secret. On startup the function fetches the secret, connects, and caches it for a few minutes. When the password rotates, the next fetch gets the new one. No developer ever sees the production password.
AWS also offers Systems Manager Parameter Store, a simpler and cheaper place for configuration values (and for secrets that do not need rotation). Secrets Manager is the choice when rotation and auditing matter.
Keep in mind
- Secrets are encrypted, read by name through the API, and access is controlled by IAM.
- Automatic rotation for RDS, Redshift and DocumentDB; custom rotation through a Lambda function for anything else.
- Every read is recorded in CloudTrail, so you know who accessed what and when.
- Priced per secret per month plus API calls; Parameter Store is the cheaper option for plain configuration.
