Skip to main content
In this lesson we’ll explore AWS Secrets Manager: a managed service for securely storing, retrieving, rotating, and auditing secrets used by applications and services. Why this matters
  • Applications that connect to databases, third-party APIs, or other services need credentials (for example, a username and password or an API key).
  • Hard-coding credentials in source code or committing them to repositories (e.g., GitHub) exposes sensitive data and increases risk of compromise.
  • Alternatives include environment variables (which still risk leakage) or a dedicated secrets management service such as AWS Secrets Manager.
What is AWS Secrets Manager?
  • A managed service to securely store, distribute, and manage secrets.
  • Eliminates plaintext credentials in source code and standard configuration files.
  • Supports secrets such as database credentials, API keys, and arbitrary configuration data (often stored as JSON strings).
How Secrets Manager stores and retrieves secrets
  • Create secrets using the AWS Management Console, AWS CLI, or any AWS SDK.
  • Each secret has a unique name and a secret value (string or binary). Common practice is to store structured secrets as a JSON string (for example, {"username":"dbadmin","password":"S3cret!"}).
  • Secrets Manager encrypts secrets at rest with AWS KMS. You can use the AWS-managed KMS key or a customer-managed key.
  • When an application requests a secret, Secrets Manager decrypts it and sends the plaintext over TLS. The secret exists in plaintext only in-memory at runtime.
Recommended runtime flow
  1. Store credentials in Secrets Manager (encrypted by KMS).
  2. When an application starts or needs credentials, call Secrets Manager to retrieve the secret.
  3. Secrets Manager returns the decrypted secret over TLS.
  4. Use the credentials at runtime and keep them in memory only as long as needed — do not persist to disk or commit to source control.
Putting this into practice
  • Use AWS SDKs (or the AWS CLI) in your application to fetch secrets at startup or on-demand.
  • Cache secrets in memory for a short, configurable period to reduce latency and API calls.
  • Ensure any automatic rotation workflow updates all dependent services and caches when secrets change.
Example: Lambda retrieving an API key The diagram below illustrates a typical pattern where an AWS Lambda function requests an API key from Secrets Manager at runtime and then calls an external API. This prevents storing the API key in source code or environment variables in plaintext.
A diagram titled "Secrets Manager for API Keys" showing AWS Lambda inside an AWS Cloud box retrieving a secret from AWS Secrets Manager and then sending the API key to an External API.
Rotation and automation
  • Secrets Manager supports automatic rotation with configurable schedules.
  • Rotation uses AWS Lambda: your rotation Lambda can generate a new credential, update the target (for example, the database), and store the updated value back in Secrets Manager.
  • AWS provides built-in rotation templates for common databases (for example, Amazon RDS) to simplify the process.
Access control and auditing
  • Use IAM policies and resource-based policies to grant least-privilege access: only allow the principals and services that need to read or manage a specific secret.
  • Secrets Manager integrates with AWS CloudTrail to log secret-related API calls for auditing and forensics.
Best practices
  • Do not embed secrets in source code or in repository-tracked configuration files.
  • Cache secrets in memory for a short duration to reduce GetSecretValue calls and latency.
  • Use automatic rotation for long-lived credentials and ensure rotation Lambda functions update all dependent components.
  • Apply least-privilege IAM policies and restrict who or what can read or modify secrets.
  • Monitor CloudTrail and set alerts for unusual secret access patterns.
Common secret types and examples CLI examples Create a secret with a JSON secret string:
Retrieve a secret value:
Summary of key features
  • Secure secret storage: encryption at rest with AWS KMS.
  • Easy retrieval: AWS SDKs and the AWS CLI reduce custom retrieval code.
  • Automatic rotation: built-in support with Lambda-based rotation workflows.
  • Fine-grained access control: IAM policies control secret access.
A presentation slide titled "Features" showing four numbered cards: "Secure Secret Storage," "Easy Retrieval," "Automatic Rotation," and "Fine-Grained Access Control," each with a colored circular icon. The layout highlights key security and usability features.
Pricing
Best practice: minimize GetSecretValue calls by caching secrets in memory where appropriate, and ensure your rotation workflow updates all dependent services when credentials change.
Links and references

Watch Video

Practice Lab