CloudGuild · Blog · Cheat sheets · Lessons · Certifications
AWS Secrets Manager vs Parameter Store — Managing Secrets and Configuration Data
Both services securely manage sensitive information but are suited for different use cases.
What it is
- AWS Secrets Manager: A service to store, manage, and retrieve secrets such as API keys, passwords, and database credentials securely.
- AWS Systems Manager Parameter Store: A service to store configuration data and secrets, with the ability to manage parameters in a hierarchical structure.
When I reach for it
- Use Secrets Manager when you need:
- Automatic rotation of secrets.
- Fine-grained access control based on IAM policies.
- Integration with AWS services like RDS and Lambda for secret retrieval.
- Use Parameter Store when you need:
- Simple storage for configuration data.
- Hierarchical organization of parameters.
- Free storage for standard parameters and limited advanced features.
Key architectural decisions
- Choose Secrets Manager for:
- Enhanced security features and automatic rotation.
- Compliance requirements that demand strict secret management.
- Choose Parameter Store for:
- Cost-effective solutions with limited secret management needs.
- Storing non-sensitive configuration alongside sensitive parameters.
Gotchas & exam traps
- Remember that Secrets Manager incurs costs based on the number of secrets and API calls, while Parameter Store has free tier limits.
- Be aware of the maximum size limit for Parameter Store parameters (4 KB for standard, 8 KB for advanced).
The architect view
- Use Secrets Manager for robust, enterprise-level secret management and automatic rotation. Opt for Parameter Store for simpler, cost-effective configurations without extensive secret management needs.