L13. Secrets Management: Secrets Manager vs Parameter Store

Secrets Manager: Rotation Built In

AWS Secrets Manager exists to solve the problem of credentials that need to change on a schedule without breaking every application that depends on them. It supports automatic rotation through AWS-provided or custom Lambda rotation functions, and ships with native rotation templates for RDS, Redshift, and DocumentDB credentials, so rotating a database password on a 30-day schedule takes configuration, not custom code. Secrets Manager also supports cross-account and cross-region secret replication, which matters for multi-account architectures where a shared credential needs to be available in more than one place without manual copying. Pricing reflects the extra capability: you pay per stored secret plus per API call, which is worth weighing against how many secrets you actually need this level of service for.

Parameter Store: Cheap Configuration Storage

Systems Manager Parameter Store stores configuration data and secrets as one of three parameter types: plain String, StringList, or KMS-encrypted SecureString. The Standard tier is free, with limits on parameter count, size, and throughput; the Advanced tier is paid and raises those ceilings, adding larger values, higher throughput, and parameter policies (for example, an expiration date on a parameter). The detail that catches people out on the exam: Parameter Store has no built-in automatic rotation. A SecureString parameter is encrypted at rest, but nothing rotates its value for you; if you want scheduled rotation, you have to build and schedule that logic yourself, typically with a Lambda function and an EventBridge rule you own end to end.

The Decision Rule

This is the framing the exam tests most directly: rotation and high-value credentials point to Secrets Manager, and everything else, especially cost-sensitive, high-volume configuration values, points to Parameter Store. A scenario mentioning "200 feature flags" is a Parameter Store signal; a scenario mentioning "database password must rotate automatically" is a Secrets Manager signal.

Shared Ground

Both services integrate with IAM for fine-grained access control (you can scope a policy down to a single secret or parameter path) and with CloudTrail for audit logging of every read and write. Neither leaves you without visibility into who accessed what and when; the difference is entirely in rotation capability, pricing model, and the intended use case. Exam tip: If a question includes the word "rotation" anywhere in its requirements, Secrets Manager is almost always the answer. If a question is about generic configuration with no rotation or database-credential angle, and cost is emphasized, Parameter Store Standard tier wins on price alone.