Security, Identity, and Compliance
CoreAWS Secrets Manager
Managed service for protecting, retrieving, and rotating secrets such as database credentials and API keys.
Key points
- Applications retrieve secrets at runtime under a workload role rather than embedding values in code.
- Supported rotation updates the secret and its target service credential.
- Caching must refresh in time to adopt a rotated version.
Best-known use cases
- Store and retrieve database credentials.
- Automate supported secret rotation independently of application deployment.
What candidates often confuse it with
- Secrets Manager supplies secret lifecycle and rotation; AppConfig supplies ordinary application configuration deployment.
- KMS key rotation does not rotate the secret value stored by Secrets Manager.
Key takeaway
Use Secrets Manager when a sensitive value needs managed retrieval, access control, and rotation lifecycle.
Related services
- AWS Key Management Service (AWS KMS)
- AWS Lambda
- Amazon RDS
Relevant exam tasks
- D2.3 — Manage sensitive data in application code
- 2.3.3 — Use secret management services to secure sensitive data