Secrets Manager, Parameter Store & KMS

In one line

Secrets belong in Secrets Manager or SSM Parameter Store, fetched at runtime through IAM — and KMS provides the encryption keys behind them and behind S3, EBS, and RDS, with key policies deciding who can decrypt.

0/4 · 0%

Think of it like this

A bank's safe deposit boxes. SECRETS MANAGER is the box holding your valuables, with a log of every opening and a service that changes the lock combination regularly (rotation). KMS is the master key system of the bank vault — it never leaves the vault; you ask it to lock or unlock things for you.

Key ideas

01
SECRETS MANAGER stores credentials, API keys, and tokens; supports AUTOMATIC ROTATION (native for RDS/Aurora/Redshift, Lambda-based for anything else), cross-region replication, and resource policies. It costs per secret per month plus API calls.
02
SSM PARAMETER STORE holds configuration and secrets (SecureString, KMS-encrypted) in a path hierarchy (/api/prod/db-url) — the standard tier is free. Use it for config and simple secrets; use Secrets Manager when you need rotation or cross-account sharing.
03
Applications fetch secrets at startup (or via ECS/EKS/Lambda native integrations) using their ROLE — never from environment files in the repo or baked into images. Cache them in memory with a refresh interval so rotation takes effect without restarts or throttling.
04
KMS manages keys that never leave AWS's HSMs. Services use ENVELOPE ENCRYPTION: KMS generates a data key, the service encrypts your data locally with it, and stores the data key encrypted under the KMS key. AWS MANAGED keys (aws/s3) are automatic; CUSTOMER MANAGED keys give you the key policy, rotation settings, cross-account sharing, and CloudTrail visibility of every use.
05
KEY POLICIES are the primary access control for a key (Phase 1.3): to read a KMS-encrypted object you need s3:GetObject AND kms:Decrypt on the key. Disabling or scheduling deletion of a key makes everything encrypted under it unreadable — deletion has a 7–30 day waiting period for exactly this reason.

Code & diagrams

secrets.shbash

# Store and rotate a secret
aws secretsmanager create-secret --name prod/payments/api-key \
  --secret-string '{"key":"sk_live_..."}' --kms-key-id alias/app-secrets

aws secretsmanager rotate-secret --secret-id prod/db/orders \
  --rotation-lambda-arn arn:aws:lambda:ap-south-1:123456789012:function:rotate-pg \
  --rotation-rules AutomaticallyAfterDays=30

# App (via its role) reads it at runtime
aws secretsmanager get-secret-value --secret-id prod/payments/api-key \
  --query SecretString --output text

# Config in Parameter Store
aws ssm put-parameter --name /api/prod/feature-flags --type String --value '{"newCheckout":true}'
aws ssm get-parameters-by-path --path /api/prod --with-decryption --recursive

kms-key-policy.jsonjson

Delegates to IAM for account admins, and lets only the app role use the key for data operations.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AccountAdminsViaIAM",
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::123456789012:root" },
      "Action": "kms:*",
      "Resource": "*"
    },
    {
      "Sid": "AppCanEncryptDecrypt",
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::123456789012:role/api-task" },
      "Action": ["kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey"],
      "Resource": "*"
    }
  ]
}

EnvelopeEncryptiondiagram

Rendering diagram…

Explain it without notes

Why is envelope encryption used instead of sending every piece of data to KMS to encrypt?

A role has s3:GetObject on a bucket but gets AccessDenied reading one object. The bucket uses SSE-KMS with a customer managed key. What's missing?

Practice

A developer committed a database password to a Git repo. List the remediation steps.

When would you choose a customer managed KMS key over the AWS managed aws/s3 key?

Trade-offs

↔
Customer managed keys give fine-grained control and auditability but add a monthly fee per key, per-request costs, and a new failure mode — a misconfigured key policy or disabled key can make data unreadable, including for your own services.

Done when you can

No secrets live in code, images, or plain environment files — they're fetched via roles at runtime.
I know when to use Secrets Manager vs Parameter Store.
I can explain envelope encryption and write a KMS key policy.
I enable rotation for database credentials.