Security, Identity, and Compliance
CoreAWS Secrets Manager
Managed storage, retrieval, and supported rotation of application secrets.
Key points
- Workloads retrieve secrets at runtime through roles instead of embedding credentials in code or images.
- Rotation can be automated for supported services and custom patterns, but applications must tolerate the lifecycle.
- KMS encrypts the stored secret; IAM/resource policy controls retrieval and administration.
Best-known use cases
- Store database credentials or API secrets.
- Rotate supported credentials without distributing static values.
What candidates often confuse it with
- Secrets Manager handles secret lifecycle and rotation; Systems Manager Parameter Store commonly stores configuration and simpler protected parameters.
- KMS protects encryption keys; Secrets Manager stores secret values encrypted under a key.
Key takeaway
Choose Secrets Manager when a workload needs centrally controlled secret retrieval and rotation.
Related services
- AWS KMS
- IAM
- AWS Systems Manager
Relevant exam tasks
- D1.2