Service comparisons / AWS Secrets Manager vs SSM Parameter Store
Secrets Manager vs Parameter Store
AWS Secrets Manager stores secrets with built-in automatic rotation and cross-account sharing; Systems Manager Parameter Store keeps configuration and secure strings cheaply, without rotation. Which one a question wants.
Last checked against AWS documentation · How we write our content
| Question | AWS Secrets Manager | SSM Parameter Store |
|---|---|---|
| Use it when | Credentials must rotate automatically, especially database passwords | You need configuration values and some secrets, cheaply |
| Rotation | Built in; managed rotation for RDS, Aurora, Redshift and DocumentDB, or your own Lambda function | None built in; you'd have to build it yourself |
| Encryption | Always encrypted with a KMS key | SecureString parameters use a KMS key; plain strings don't |
| Sharing | Resource policies for cross-account access; replicates secrets to other Regions | Within the account; advanced parameters can be shared through AWS RAM |
| Cost | A monthly charge per secret, plus API calls | Standard parameters are free; advanced parameters and higher throughput cost extra |
Both keep values out of code and environment files, and applications read both through IAM-controlled API calls. The deciding words in a question are usually rotation and cost.
How to choose
- “Rotate the database password automatically every 30 days”: Secrets Manager.
- “Store configuration such as feature flags, endpoints and AMI IDs”: Parameter Store, with paths like
/prod/app/db-host. - “Lowest cost” for a few secrets that don’t need rotation: Parameter Store SecureString.
- A secret used by another account or another Region: Secrets Manager.
Exam traps
- Hard-coding credentials, or putting them in Lambda environment variables in plain text, is never the right answer.
- Applications should cache secrets (the AWS caching libraries and the Lambda extension do this) instead of calling the API on every request.
- After rotation, apps must fetch the new value. Rotation that “breaks the app” usually means the app read the secret once at startup.
- Parameter Store can reference Secrets Manager secrets, so code can read both through one API.