AWS Secrets Manager

AWS Secrets Manager is a fully managed service that handles the secure storage, retrieval, and rotation of sensitive information such as database credentials, API keys, OAuth tokens, and other secrets. It eliminates the need for hardcoded credentials in application source code by providing a runtime API for dynamic secret retrieval.

Secrets are encrypted at rest using AWS Key Management Service (KMS) and transmitted securely over TLS. Access control is managed through AWS Identity and Access Management (IAM) policies, allowing fine-grained permissions at the secret level. The service supports automatic rotation on schedules or on demand, with built-in rotation for Amazon RDS, DocumentDB, and Redshift, plus extensible Lambda-based rotation for third-party services.

Key features

• Encryption at rest and in transit using KMS keys you own and control
• IAM integration for fine-grained access policies and resource-based permissions
• Automatic rotation with native support for AWS databases and third-party SaaS providers
• Multi-region replication for disaster recovery and cross-regional redundancy
• VPC endpoints to keep traffic within the AWS network
• Client-side caching libraries to reduce latency and improve availability
• Audit logging via AWS CloudTrail and monitoring through CloudWatch

Use cases

• Eliminating hardcoded credentials from application code and configuration files
• Rotating database credentials automatically without application redeployment
• Managing API keys and OAuth tokens for third-party service integrations
• Supporting compliance requirements for secrets management and access auditing
• Enabling cross-region disaster recovery with replicated secrets

Limitations

• Requires AWS account and connectivity; not suitable for air-gapped or non-AWS environments without hybrid networking
• Rotation functions incur additional AWS Lambda charges beyond the base Secrets Manager pricing
• Custom KMS keys for encryption are billed separately at standard AWS KMS rates
• API call throttling limits may require client-side caching for high-throughput applications
• Native rotation support is limited to specific AWS services and select third-party providers; custom rotation requires Lambda development
• Secrets marked for deletion remain in a 7-day recovery window before permanent removal, which may delay complete cleanup