AWS Secrets Manager

What AWS Secrets Manager is

AWS Secrets Manager manages credentials, API keys, and other secrets used by applications, services, and IT resources throughout their lifecycle. Applications can retrieve individual secrets or groups of secrets using names, ARNs, or tag filters, and client-side caching libraries are available. Secrets can be rotated on a schedule or on demand through the console, AWS SDK, or AWS CLI. The service can also replicate secrets across AWS Regions and keep regional read replicas synchronized.

Secrets are encrypted at rest with AWS Key Management Service keys and sent over TLS when retrieved. AWS Identity and Access Management supports fine-grained access control through IAM and resource-based policies. For auditing, monitoring, and notifications, Secrets Manager integrates with AWS CloudTrail, Amazon CloudWatch, Amazon SNS, and Amazon EventBridge. Listed AWS integrations include Amazon RDS, Amazon Redshift, Amazon DocumentDB, Amazon MSK, Amazon SageMaker, AWS CodeBuild, and AWS Transfer Family. Managed rotation integrations include Salesforce, BigID, Snowflake, MongoDB Atlas, and Confluent Cloud. Managed external secrets provides predefined partner formats and Lambda-free automatic rotation for third-party credentials. The cloud service is available through API and web.

Who it suits

AWS Secrets Manager suits IT administrators, security administrators, and developers replacing hard-coded secrets in applications. It is also relevant to teams that need scheduled or on-demand secret rotation, regional replication, and auditing integrations.

Limits

The AWS Free Tier plan provides up to $200 in AWS Free Tier credits and is available six months after account creation; credits expire within 12 months of account creation. Pay-as-you-go is $0.40 per secret per month plus $0.05 per 10,000 API calls. Customer-managed AWS KMS keys and automatic rotation other than managed rotation can incur additional charges.

Getting started

1. Open the AWS Secrets Manager website.
2. Choose the AWS Free Tier or Pay-as-you-go plan.
3. Use the web console or AWS SDK to manage secrets.
4. Configure access with IAM or resource-based policies.
5. Set rotation on a schedule or on demand, if needed.
6. Retrieve secrets through the API or use a client-side caching library.

Verdict

Choose AWS Secrets Manager if you need lifecycle management for application credentials and want rotation, regional replication, and AWS monitoring integrations. Review the usage charges for secrets and API calls, along with any KMS or Lambda costs that apply to your setup.