ACKF logoACKF
Security, Identity, and Compliance

AWS Secrets Manager

View on GitHub

AWS Secrets Manager

A regional managed service for securely storing, managing, and retrieving secrets such as database credentials, API keys, and other confidential configuration. It provides an API and SDK integrations that applications and AWS services use to retrieve secrets at runtime and can perform automatic rotation for supported targets using configurable Lambda functions. Secrets Manager typically sits between identity controls (IAM, KMS) and application runtimes to centralise secret lifecycle management and access auditing.

🗂 Resource Category

Security, Identity, and Compliance • Management and Governance

🧠 Exam Memory Hook

Think: "Central secret storage + automatic rotation + IAM access control = AWS Secrets Manager"

📖 Ownership

Classification: AWS Managed Service

AWS responsibilities: AWS operates and patches the underlying service platform and physical infrastructure, maintains the Secrets Manager control plane, and manages high-availability of the managed service endpoints. AWS integrates Secrets Manager with AWS Key Management Service for envelope encryption and records Secrets Manager API calls in AWS CloudTrail when enabled. AWS does not manage customer application code, client runtimes, or customer-managed resources that use secrets.

Customer responsibilities: The customer configures secrets, resource policies, IAM permissions, KMS keys and grants, rotation configuration (including the rotation Lambda code and permissions), secret lifecycle rules, and monitoring/alerting. The customer is responsible for securing access credentials in their applications, rotating secrets according to policy, auditing access using CloudTrail and CloudWatch, and handling any application-level secret usage or caching securely.

Patching responsibilities: AWS patches the physical infrastructure and the managed Secrets Manager control plane and service runtime. There is no guest operating system or hypervisor exposed to customers for Secrets Manager; therefore customers do not patch those layers for this service. Customers are responsible for patching and maintaining their application code, any runtime environments they deploy (for example Lambda function code and packaged dependencies they provide), and any client libraries used to retrieve secrets.

🏗 Typical Architecture

💡 Top 5 Features

  • Securely store arbitrary secrets encrypted with AWS KMS-managed keys.
  • Support for scheduled automatic rotation of secrets using customer-provided or template Lambda functions for supported targets.
  • Fine-grained access control using IAM policies and resource-based policies on secrets.
  • Secret versioning with staging labels to enable safe rotation and phased rollouts.
  • Audit of Secrets Manager API activity through AWS CloudTrail for access and management events.

✅ Top 5 Use Cases

  • Centralise database credentials for applications and rotate credentials automatically for supported database engines to reduce risk from long-lived credentials.
  • Provide short-lived credentials and API keys to serverless functions and containers at runtime without embedding secrets in code or configuration.
  • Store and manage third-party API keys and service credentials with controlled access and audit trails for compliance requirements.
  • Manage application configuration secrets and staging-labelled versions to perform safe secret rotations and rollbacks during deployments.
  • Enable automated credential rotation workflows that invoke a rotation Lambda to update both the secret and the target resource credentials.

🏗 Architecture Placement

Secrets Manager is a regional, account-level service that acts as the central secret store in an AWS architecture. Applications, compute services (for example Lambda, EC2, ECS), and administrative tools request secrets from Secrets Manager at runtime, while IAM controls who may read or manage each secret and KMS provides encryption. When rotation is enabled, Secrets Manager invokes configured Lambda functions to update secrets in target resources such as supported databases.

🎯 Commonly Used With

- AWS Identity and Access Management
- AWS Key Management Service
- AWS Lambda
- Amazon RDS
- Amazon CloudWatch

🌍 5 Real-World Examples

  • A financial services application uses Secrets Manager to store database credentials and automatically rotate them to reduce the blast radius if credentials are exposed.
  • A healthcare integration platform stores third-party API keys in Secrets Manager and restricts retrieval to a specific service role to meet audit requirements.
  • An online retailer supplies payment gateway credentials to Lambda checkout functions from Secrets Manager so credentials are not embedded in deployment packages.
  • A government data-processing pipeline centralises service account keys in Secrets Manager and uses CloudTrail logs for access auditing during compliance reviews.
  • A SaaS provider manages staging-labelled secrets for phased credential rollouts, enabling rollback to a previous version if a rotation causes issues.

🎓 AWS Exam Clues

  • Use when centralised secret storage with IAM-based access control and rotation is required.
  • Prefer Secrets Manager over parameter storage when automatic rotation and secret versioning are required for secrets.
  • Consider the need to provide and maintain rotation Lambda code and permissions when planning automatic rotation.
  • Design access using least privilege IAM policies and audit access using CloudTrail and CloudWatch logs for compliance.
  • Secrets Manager stores secrets encrypted with KMS keys, so planning key policies and cross-account access affects secret access.

📝 Quick Revision

AWS Secrets Manager centrally stores and retrieves secrets and supports automatic rotation for supported targets using Lambda. Use it when you need managed secret lifecycle (storage, versioning, rotation, and audit), and ensure you design IAM permissions, KMS key access, rotation Lambda code, and monitoring before production use.

🏷 Keywords

secret rotation • secret versioning • AWS KMS • resource policy • rotation Lambda • staging labels • CloudTrail audit • IAM access control • automatic rotation • secret replication • cross-account access • envelope encryption