Back to all tools
AWS Secrets Manager
Rotate, manage, and retrieve AWS credentials and secrets throughout their lifecycle.
Free-Limited
Security Secrets Management Cloud Platform
Overview
A service to protect secrets needed to access your applications, services, and IT resources.
Key Features
- Automatic secret rotation for RDS, Redshift, and DocumentDB credentials
- Fine-grained IAM policies for controlling who can access which secrets
- Versioning and staging labels for zero-downtime secret rotation
- Cross-account secret sharing via resource-based policies
- Audit trail via CloudTrail for every secret access
- Native integration with ECS, EKS, Lambda, and EC2
Real-World Workflows
Automatic RDS credential rotation
- 1Store the RDS master password as a secret in Secrets Manager
- 2Enable automatic rotation with a 30-day schedule
- 3Rotation Lambda creates a new credential in RDS and updates the secret
- 4Application retrieves the current secret via SDK on each connection
- 5Old credential is automatically deprecated after the rotation window
Injecting secrets into ECS tasks
- 1Store API keys and database URLs as secrets in Secrets Manager
- 2Reference the secret ARN in the ECS task definition's secrets block
- 3ECS injects the secret value as an environment variable at container start
- 4Task role grants only the specific secrets the container needs
Getting Started
# Store a secret:
aws secretsmanager create-secret \
--name MySecret --secret-string '{"user":"admin","pass":"s3cr3t"}'
# Retrieve it:
aws secretsmanager get-secret-value --secret-id MySecretCompare Alternatives
See how AWS Secrets Manager stacks up against similar tools.