Security, Identity, and Compliance
AWS Secrets Manager
AWS Secrets Manager stores, retrieves, and rotates credentials, API keys, and other secrets. GenAI applications use it for database credentials or third-party tool tokens without embedding values in code, images, or prompts.
Key points
- Resource policies and IAM govern secret retrieval
- Rotation functions can replace supported or custom credentials
- Version stages distinguish current, pending, and previous secret values
When to use it
- Provide an agent tool with a scoped SaaS API credential
- Rotate the password used by a retrieval service database client
Exam tips
- Choose Secrets Manager for rotatable secrets and Systems Manager Parameter Store for general configuration
- Cache secrets only within safe lifetime bounds and never log the returned value