AWS Secrets Manager
Managed storage and automatic rotation for credentials, API keys, and other secrets.
Verified against AWS documentation · 2026-08-27
Key facts
- 01Secrets encrypted at rest with KMS (default aws/secretsmanager key or your own CMK) — never stored or returned in plaintext at rest
- 02Automatic rotation via Lambda; managed rotation templates exist for RDS, Redshift, and DocumentDB — anything else needs a custom rotation function
- 03Versioning with staging labels (AWSCURRENT / AWSPENDING / AWSPREVIOUS) so apps never read a half-rotated credential
- 04Limits: 64 KB max secret size, 500,000 secrets per Region per account, cross-Region replication supported
Exam triggers
Phrases and scenarios that point here.
- "Automatic rotation", "rotate database credentials" → Secrets Manager, full stop — Parameter Store can't rotate natively
- "Hardcoded credentials in code / config files" → move them to Secrets Manager, retrieve at runtime via IAM
- "Share credentials across accounts" → Secrets Manager resource policy + KMS CMK (the default key can't cross accounts)
- Free option acceptable + no rotation needed → Parameter Store Standard tier, not Secrets Manager
Not this service
- Static config values, feature flags, plain parameters → SSM Parameter Store (Standard tier is free)
- Managing the encryption keys themselves → KMS
- Certificates for load balancers / CloudFront → ACM
Use cases
- 01Rotating an RDS password every 30 days without a deploy — the app fetches the secret at runtime, so the credential changes and nothing ships
- 02Killing the .env file: a Lambda or ECS task pulls its third-party API keys at startup via IAM role instead of baked-in environment secrets
- 03One database secret shared by staging services across two accounts through a resource policy, instead of copy-pasting the password into both
- 04Cross-Region replication of secrets so a DR failover in the second Region starts with working credentials, not a manual re-entry step
- 05Storing a full DB connection bundle (host, port, user, password) as one JSON secret so rotation updates everything atomically
How it's charged
- 01Per secret per month for storage, prorated hourly — short-lived secrets only cost their lifetime
- 02Per 10,000 API calls — a service that fetches on every request instead of caching turns the cheap line item into the expensive one
- 03Each cross-Region replica bills as its own full secret, plus that Region's API calls — replicating everything doubles the storage line
- 04Rotation itself has no separate fee, but the rotation Lambda's invocations and any customer-managed KMS key bill on their own services
- 05Secrets pending deletion (the 7–30 day recovery window) don't accrue storage charges
