AWS Secrets Manager
Store passwords, API keys
Stores passwords, API keys and DB connection info encrypted; can automatically rotate passwords on a schedule.
- Cost$ Low
- Difficulty●●●●●
- Costs money when idle?Yes
- Managed by AWS
- In examsSAA · DVA · SOA
Think of it asLike a password safe that changes its own combination every month.
Where does Secrets Manager fit?
Calls Secrets Manager
Secrets ManagerSecrets Manager calls
A real example, step by step
- The database password lives in a .env file and has already leaked to GitHub once.
- You store the database credentials in Secrets Manager, encrypted with KMS.
- The app's IAM role may read exactly that secret, and the app fetches the password at startup instead of reading a file.
- You turn on automatic rotation every 30 days; Secrets Manager changes the password in RDS and updates the secret.
- The app always reads the latest version, so a password change causes no disruption.
When to use it
✓ Use it when
You don't want passwords in code/environment variables.
✗ Avoid it when
Non-secret configuration where cheap matters → Parameter Store (Systems Manager).
Common uses
- Store database passwords and rotate them automatically
- Store third-party API keys
- Share secrets across accounts
Secrets Manager, Systems Manager or KMS?
| Secrets Manager |  Systems Manager |  KMS | |
|---|---|---|---|
| Stores | Secrets: passwords, API keys | Configuration and simple secrets (Parameter Store) | Encryption keys |
| Automatic rotation | Yes, built in for RDS/Aurora | No | Rotates keys, not passwords |
| Replication to other regions | Yes | No | Multi-Region keys |
| Billing | Per secret per month + calls | Standard tier is free | Per key per month + calls |
What does it cost?
- Pricing model: $0.40/secret/month + $0.05/10,000 API calls.
- Free tier: 30-day trial for new secrets.
Calling the API on every request instead of caching in the app; unused secrets are still billed; non-secret configuration belongs in Parameter Store (free).
“Rotate database passwords automatically” with “least operational overhead” → Secrets Manager. Configuration only, cheaply → Parameter Store. Don't pick KMS to “store passwords”: KMS holds encryption keys and doesn't rotate database passwords.
Try real exam questions
1A company uses Amazon RDS for PostgreSQL databases for its data tier. The company must implement password rotation for the databases. Which solution meets this requirement with the LEAST operational overhead?
- AStore the password in AWS Secrets Manager. Enable automatic rotation on the secret.
- BStore the password in AWS Systems Manager Parameter Store. Enable automatic rotation on the parameter.
- CStore the password in AWS Systems Manager Parameter Store. Write an AWS Lambda function that rotates the password.
- DStore the password in AWS Key Management Service (AWS KMS). Enable automatic rotation on the customer master key (CMK).
Show answer
Correct answer: A
Secrets Manager has built-in automatic password rotation for RDS — you just turn it on. Parameter Store doesn't rotate; rotating a KMS key doesn't change a database password.
2A company has a custom application with embedded credentials that retrieves information from an Amazon RDS MySQL DB instance. Management says the application must be made more secure with the least amount of programming effort. What should a solutions architect do to meet these requirements?
- AUse AWS Key Management Service (AWS KMS) customer master keys (CMKs) to create keys. Configure the application to load the database credentials from AWS KMS. Enable automatic key rotation.
- BCreate credentials on the RDS for MySQL database for the application user and store the credentials in AWS Secrets Manager. Configure the application to load the database credentials from Secrets Manager. Create an AWS Lambda function that rotates the credentials in Secrets Manager.
- CCreate credentials on the RDS for MySQL database for the application user and store the credentials in AWS Secrets Manager. Configure the application to load the database credentials from Secrets Manager. Set up a credentials rotation schedule for the application user in the RDS for MySQL database using Secrets Manager.
- DCreate credentials on the RDS for MySQL database for the application user and store the credentials in AWS Systems Manager Parameter Store. Configure the application to load the database credentials from Parameter Store. Set up a credentials rotation schedule for the application user in the RDS for MySQL database using Parameter Store.
Show answer
Correct answer: C
Store the credentials in Secrets Manager, have the app read them from there instead of embedding them in code, and schedule rotation with the built-in RDS support rather than writing your own Lambda.
Frequently asked questions
How does automatic rotation work?
On a schedule, Secrets Manager calls a Lambda function that creates a new password, updates it in the database and stores the new version. For RDS, Aurora, Redshift and DocumentDB there are ready-made templates or AWS-managed rotation, so you write almost no code.
How is Secrets Manager priced?
Each secret has a monthly fee, plus charges per API call. Storing lots of non-secret configuration here costs money for nothing; keep it in Parameter Store instead.
What do AWS exams ask about Secrets Manager?
Keeping passwords out of code and plain-text environment variables, rotating database passwords automatically, choosing between Secrets Manager and Parameter Store based on cost and features, and encryption with KMS.