Secrets Manager vs Parameter Store
AWS Secrets Manager and AWS Systems Manager Parameter Store overlap: both store values, both encrypt them with AWS KMS, and both control access through IAM. The distinction is rotation and cost.
Use Secrets Manager for credentials that must be rotated, and where the cost per secret is immaterial next to the consequence of a leak.
Use Parameter Store for configuration data, and for secrets where the free tier and the hierarchy matter more than automatic rotation.
Side by side
Section titled “Side by side”| AWS Secrets Manager | Parameter Store | |
|---|---|---|
| Primary purpose | Storing and rotating secrets | Storing configuration data, with encrypted values as an option |
| Rotation | Managed rotation for RDS, Aurora, DocumentDB, Redshift and ECS Service Connect; Lambda rotation for anything else | None. Rotation must be built externally |
| Encryption | Always encrypted with a KMS key | SecureString parameters are encrypted with a KMS key; String parameters are not |
| Maximum value size | 65,536 bytes | 4 KB standard tier, 8 KB advanced tier |
| Hierarchy | Names may contain slashes, and IAM policies can match a prefix | Explicit hierarchical paths, with GetParametersByPath |
| Versioning | Versions with staging labels (AWSCURRENT, AWSPENDING, AWSPREVIOUS) | A numbered version history per parameter |
| Cross-Region replication | Built in | Not built in |
| Cross-account sharing | Resource-based policy on the secret | Advanced tier parameters, shared through AWS RAM |
| Cost | Per secret per month, plus per API call | Standard tier free; advanced tier charged per parameter, plus charges for higher throughput |
Where AWS KMS fits
Section titled “Where AWS KMS fits”KMS is not an alternative to either. It is the key service both of them call.
- AWS KMS manages keys. It creates and controls the cryptographic material, performs encrypt, decrypt, sign and verify operations, and records every use in CloudTrail. It does not store application secrets.
- Secrets Manager stores secrets and encrypts them by calling KMS. It adds rotation, versioning and replication on top.
- Parameter Store stores parameters, and encrypts
SecureStringvalues by calling KMS.
So the three stack rather than compete: KMS holds the key, Secrets Manager or Parameter Store holds the value, and IAM decides who may ask for it. The one thing KMS rotation and secret rotation have in common is the word — KMS rotates key material under an unchanged key ID, while Secrets Manager replaces the credential itself.
Choosing
Section titled “Choosing”Reach for Secrets Manager when:
- The value is a database credential, API key or token whose rotation is a stated requirement
- The database is RDS, Aurora, DocumentDB or Redshift, where rotation is managed for you
- The secret must be replicated to other Regions
- The secret must be shared with another AWS account
- The value is larger than 8 KB
Reach for Parameter Store when:
- The value is configuration — a feature flag, an endpoint URL, an AMI ID, a licence code
- There are many small values and the per-secret cost of Secrets Manager would be significant
- The hierarchy is useful:
/myapp/prod/db/host, retrieved as a set withGetParametersByPath - The value is already managed by something else, and nothing needs to rotate it
Both are frequently used in the same application: Parameter Store for the configuration and Secrets Manager for the credentials.