Loading…
While this loads — worth knowing
ElastiCache RedisnotElastiCache Memcached
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
Loading…
While this loads — worth knowing
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
Stores database passwords, API keys and tokens, hands the current one to applications when they run, and rotates them on a schedule.
Where Secrets Manager takes you5 steps, all open
Secrets Manager stores the credentials your applications need, such as database passwords, API keys and OAuth tokens, and can rotate them on a schedule. Instead of a password in the code or a config file, the application asks for the secret by API while it runs.
Rotation is the point. A secret can change as often as every four hours with nothing redeployed, because the application reads the current version each time. RDS can even create its master password, keep it here and rotate it for you.
A hotel key desk. Guests do not carry a master key; they show who they are at the desk and are handed today's key. At night the locks are changed, the new key is tried in the door first, and yesterday's key goes in a drawer in case something goes wrong.
SecretGetSecretValueAWSCURRENTAWSPENDINGAWSPREVIOUSRotationA new version of the secret is made, holding a new password, and labelled AWSPENDING.
The database or service is changed to accept the credentials in AWSPENDING.
The AWSPENDING version is used to sign in, to show that it works.
AWSCURRENT moves to the new version, and the old one is labelled AWSPREVIOUS.
Pick a case to follow the rotation through each check.
The password lives in one place. Every app server reads it from Secrets Manager while it runs, so a rotation changes it for all of them at once.
Managed rotation needs no function. A secret managed by another service, such as the RDS master password, is rotated by that service. Otherwise a Lambda function does it, charged at Lambda's rates.
Replicas for other Regions. A secret can be copied to other Regions; rotating the primary updates the replicas, and a replica can be promoted to stand alone.
Encrypted with KMS. Each secret is protected by envelope encryption under a KMS key: aws/secretsmanager, or a customer managed key whose key policy you write.
IAM decides who reads it, and each read is an API call CloudTrail can record.
No person needs to see it. When RDS manages the master password, it is kept from human access and from plain-text view.
Deleting has a safety net. A deleted secret waits out a recovery window of at least 7 days and can be restored until then, unless you force deletion with no window at all.
Per secret per month, each replica counting as a secret of its own.
Per 10,000 API calls.
Rotation by a Lambda function is charged at Lambda's rates.
Secrets marked for deletion are not charged. The aws/secretsmanager key is free; a customer managed key is charged as KMS charges it.
Prices change, so none are printed here. Check the Secrets Manager pricing page on aws.amazon.com.
| Service | Stores | Rotation | Charged | Choose it when |
|---|---|---|---|---|
| Secrets Manager | Credentials, API keys, tokens | Built in, on a schedule | Per secret, and per API call | Credentials that must change |
| Parameter Store | Strings, string lists, SecureStrings | None built in | Standard tier free, advanced charged | Configuration, and secrets that never rotate |
| KMS | Encryption keys | Key material, yearly by default | Per key, and per request | Encrypting data, never storing passwords |
| Parameter Store tier | Parameters | Largest value | Parameter policies |
|---|---|---|---|
| Standard | Up to 10,000 | 4 KB | No |
| Advanced | Up to 100,000 | 8 KB | Yes |
| What | Where AWS says to keep it |
|---|---|
| Database passwords and API keys | Secrets Manager |
| AWS credentials for your code | An IAM role |
| Encryption keys | KMS |
| SSH access to EC2 | EC2 Instance Connect |
| TLS certificates | ACM |
rotate the database password automatically, with no application changesSecrets Manager
Applications read the current version while running, so a rotation needs no redeploy.
store configuration and simple secrets as cheaply as possible, no rotationParameter Store SecureString
Its standard tier is free, and it has no rotation built in.
credentials for an application on EC2 to call AWS APIsAn IAM role, not a secret
AWS recommends roles for AWS credentials, leaving nothing long-lived to store.
the same secret must be ready in a second Region for disaster recoveryReplicate the secret
Rotating the primary reaches its replicas, and a replica can be promoted.
rotate a secret every hourNot possible
The shortest rotation schedule is every four hours.
nobody may ever see the RDS master passwordLet RDS manage it in Secrets Manager
RDS generates it, stores it, and rotates it every seven days by default.
a secret was deleted by mistake yesterdayRestore it
It waits out a recovery window of at least 7 days before it is gone.
rotation failed, and now every attempt says one is already in progressAWSPENDING is left on another version
Until that is sorted out, each later rotation returns an error.
encrypt the secrets with a key the security team controlsA customer managed KMS key
The default is aws/secretsmanager; a customer managed key comes with a key policy you write.
An application on EC2 connects to an RDS for MySQL database with a password kept in a configuration file. Auditors require the password to change every 30 days, without anyone seeing it and without redeploying the application. What should a solutions architect do?
App servers in an Auto Scaling group sign in to a database with a password. The password must stay out of the code, be read by the servers as they run, and change automatically every 30 days with nothing redeployed. Where do the app servers get the password?
4 hours at most.7 days.7 days.This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.
Every fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.