AWS Secrets Manager

Secrets Manager stores sensitive values and can rotate them automatically.

AWS Secrets Manager is purpose-built for secrets. Compared to Parameter Store it adds automatic rotation — it can change a database password on a schedule and update the stored value with no downtime.

When to reach for it

  • Database credentials that must rotate on a schedule.
  • Secrets shared across many services with fine-grained IAM access.
  • Native rotation integration with RDS.

It costs a small amount per secret per month, so use Parameter Store for simple config and Secrets Manager where rotation or tight auditing matters.

Example

Example · bash
# Create a rotatable secret
aws secretsmanager create-secret \
  --name myapp/prod/db \
  --secret-string '{"username":"app","password":"s3cr3t"}'

# Read it (e.g. from app startup)
aws secretsmanager get-secret-value \
  --secret-id myapp/prod/db --query SecretString --output text

When to use it

  • A team stores database credentials in Secrets Manager and enables automatic rotation every 30 days so the password changes without any code deployment.
  • A Lambda function calls Secrets Manager at runtime to retrieve a third-party API key so the key is never baked into the deployment package.
  • An ops engineer uses Secrets Manager resource policies to allow only specific ECS task roles to retrieve a given secret.

More examples

Create a secret with JSON value

Stores a JSON blob with database credentials in Secrets Manager so apps can parse username, password, and host together.

Example · bash
aws secretsmanager create-secret \
  --name prod/myapp/db \
  --secret-string '{"username":"admin","password":"S3cr3t!","host":"db.example.com"}'

Read secret in application code

Retrieves the JSON secret and parses the host field, showing how a deploy script can extract individual values.

Example · bash
# Retrieve and parse a JSON secret
SECRET=$(aws secretsmanager get-secret-value \
  --secret-id prod/myapp/db \
  --query 'SecretString' \
  --output text)

DB_HOST=$(echo $SECRET | python3 -c 'import sys,json; print(json.load(sys.stdin)["host"])')

Enable automatic secret rotation

Enables 30-day automatic rotation using a Lambda function that updates the credential in both the database and Secrets Manager.

Example · bash
aws secretsmanager rotate-secret \
  --secret-id prod/myapp/db \
  --rotation-rules AutomaticallyAfterDays=30 \
  --rotation-lambda-arn arn:aws:lambda:us-east-1:123456789012:function:rotate-db-secret

Related

deploy ssm paramsdeploy ecs secrets

Discussion

  • Be the first to comment on this lesson.