AWS Secrets Manager
A service for managing and protecting sensitive credentials and secrets in cloud environments.
| Category | Secrets Management |
|---|---|
| This page updated | a month ago |
| Pricing Details | Pricing based on the number of secrets stored and API calls made. |
| Target Audience | Developers and organizations needing secure management of sensitive credentials. |
AWS Secrets Manager is designed for managing and protecting sensitive credentials and secrets within cloud environments. It centralizes the storage, encryption, and rotation of database credentials, API keys, OAuth tokens, and other secrets, eliminating the need for hard-coded credentials in application source code.
The technical architecture of Secrets Manager leverages AWS Identity and Access Management (IAM) for fine-grained access control, ensuring that only authorized users and services can access the secrets. Secrets are encrypted using AWS Key Management Service (KMS) keys, with the option to use either AWS-managed keys or customer-managed keys. The service supports automatic rotation of secrets, which can be scheduled or triggered on demand, utilizing AWS Lambda functions to handle the rotation process without disrupting active applications.
Operationally, Secrets Manager integrates with AWS logging, monitoring, and notification services, such as AWS CloudTrail, to provide comprehensive auditing and monitoring of secret usage. This includes generating CloudTrail log entries for secret retrievals and other management events. However, this integration can incur additional costs for log storage and notification services.
Technically, Secrets Manager supports HTTPS Query API and AWS SDKs for various programming languages, allowing for programmatic access and automation. The service uses TLS 1.2 and 1.3 for secure communication and offers FIPS 140-2 compliant endpoints. While the service is highly scalable, costs can accumulate from secret storage, rotation, and log storage, particularly in multi-account setups or with extensive use of custom KMS keys and Lambda functions for rotation.