# AWS Secrets Manager

> A locked vault for passwords and API keys, so they never live in your code.

- Level: Intermediate
- Topics: AWS, Security
- URL: https://tidbit.legios.com.ar/aws-secrets-manager/
- In Spanish: [AWS Secrets Manager](https://tidbit.legios.com.ar/es/aws-secrets-manager/)

**AWS Secrets Manager** stores the sensitive values an application needs: database passwords, API keys for third-party services, private keys, tokens. You save a secret under a name such as `prod/payments/stripe-key`, and your code asks for it by name at runtime through the AWS API, with IAM deciding who is allowed to read it. The value is encrypted at rest and never printed in logs.

The problem it attacks is secrets in the wrong place: inside source code, in a config file committed to Git, in an environment variable visible to anyone who can log in to the server. Once a password reaches a repository it is effectively public, even after you delete it. Secrets Manager also **rotates** secrets: for an Amazon RDS database it can change the password every 30 days on its own and update the stored value, so a leaked credential has a short life.

Example: an AWS Lambda function needs to connect to a database. Its IAM role allows `secretsmanager:GetSecretValue` on one specific secret. On startup the function fetches the secret, connects, and caches it for a few minutes. When the password rotates, the next fetch gets the new one. No developer ever sees the production password.

AWS also offers Systems Manager Parameter Store, a simpler and cheaper place for configuration values (and for secrets that do not need rotation). Secrets Manager is the choice when rotation and auditing matter.

## An analogy

The key safe at a hotel reception. Staff who need the master key sign it out and return it; nobody carries it around in a pocket or writes the combination on a sticky note.

## Keep in mind

- Secrets are encrypted, read by name through the API, and access is controlled by IAM.
- Automatic rotation for RDS, Redshift and DocumentDB; custom rotation through a Lambda function for anything else.
- Every read is recorded in CloudTrail, so you know who accessed what and when.
- Priced per secret per month plus API calls; Parameter Store is the cheaper option for plain configuration.

## Go deeper

- [What is AWS Secrets Manager? (official docs)](https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html)
- [AWS Secrets Manager product page](https://aws.amazon.com/secrets-manager/)

## Related terms

- [Database](https://tidbit.legios.com.ar/database/): An organized store of data that programs can search and update safely.
- [API key](https://tidbit.legios.com.ar/api-key/): A secret string that identifies your app when it calls someone else's API.
- [Token](https://tidbit.legios.com.ar/token/): The small chunk of text a language model actually reads.
- [API](https://tidbit.legios.com.ar/api/): The menu of things one program lets another program ask for.
- [IAM](https://tidbit.legios.com.ar/iam/): The rulebook that says who can do what in your AWS account.
- [Encryption](https://tidbit.legios.com.ar/encryption/): Scrambling data so that only someone with the key can read it.
- [Source code](https://tidbit.legios.com.ar/source-code/): The human-readable text that programmers write and that a program is built from.
- [Git](https://tidbit.legios.com.ar/git/): A time machine for code: every change saved, by whom and why.