Guide · Security
AWS Secrets Manager vs Parameter Store
Both store secrets. When to use Secrets Manager vs Parameter Store—rotation, cost, and use cases.
Choose a backend that can satisfy APRF pass conditions (no long-lived plaintext in repos or clients). Primary control: Secrets Management
Both beat secrets in git; they solve different jobs
Put API keys and DB passwords in AWS, not `.env` committed to a repo. One team learned that when a password in a config file hit a public remote and got scraped. Secrets Manager and Parameter Store both encrypt and IAM-gate access—pick by rotation and cost, not brand preference.
Choose by rotation and price
Secrets Manager when you need managed rotation (RDS/Redshift/DocumentDB), cross-account pull, and you're fine paying per secret (~$0.40/secret/month). Strong CloudTrail story for audits.
Parameter Store when you need cheap/simple SecureString params for Lambda/ECS, free-tier standard parameters, and rotation is your own job (or not needed).
Many stacks use both: Manager for database credentials with rotation; Parameter Store for app config and non-rotating API keys.
Custody rules either way
Never put provider keys in frontend code. Scope IAM get-secret/get-parameter to the workload that needs them. APRF Secrets Management cares that secrets are stored, rotated, and fetched—not which AWS product logo is on the console.
Next: Secrets Management
Open the related pillar specification for mandatory checks, artifacts, and pass conditions. Self-attest is optional.
Related
Frequently asked questions
- When should I use Secrets Manager vs Parameter Store?
- Use Secrets Manager when you need automatic rotation (e.g., RDS credentials) or cross-account access. Use Parameter Store for simple key-value storage and when cost matters.
- Is Parameter Store free?
- Standard parameters are free. Advanced parameters (large values, high throughput) cost more. Secrets Manager costs $0.40/secret/month.
- Does Parameter Store support secret rotation?
- No. Parameter Store doesn't support automatic rotation. Use Secrets Manager for RDS, Redshift, and DocumentDB credential rotation.