Learn
AWS
Security, identity & compliance
Secrets Manager

AWSGCP laterAzure later

Secrets ManagerAWS Secrets Manager

Security, identity & complianceCore service · full depthFree while we build the libraryChecked against AWS docs · 15 Sept 2026

Stores database passwords, API keys and tokens, hands the current one to applications when they run, and rotates them on a schedule.

In the examsSolutions Architect – AssociateHIGHSolutions Architect – ProfessionalMEDDeveloper – AssociateHIGHSysOps Administrator – AssociateMEDSecurity – SpecialtyHIGH

Where Secrets Manager takes you5 steps, all open

I know the problem it solves
I can picture it
I know when to choose it
I can use it in a design
I can answer an exam question

What & why

No password in the code

Secrets Manager stores the credentials your applications need, such as database passwords, API keys and OAuth tokens, and can rotate them on a schedule. Instead of a password in the code or a config file, the application asks for the secret by API while it runs.

Rotation is the point. A secret can change as often as every four hours with nothing redeployed, because the application reads the current version each time. RDS can even create its master password, keep it here and rotate it for you.

Reach for it when

a database password must not live in the code
credentials must change automatically, on a schedule
the same secret is needed in several Regions
an application calls a third party with an API key

It is the wrong tool when

your code needs AWS credentials: give it an IAM role
you need keys to encrypt data: that is KMS
you are storing plain configuration that never rotates: Parameter Store

Mental model

The hotel's key desk

A hotel key desk. Guests do not carry a master key; they show who they are at the desk and are handed today's key. At night the locks are changed, the new key is tried in the door first, and yesterday's key goes in a drawer in case something goes wrong.

The key deska store you ask while runningSecret

Showing who you arethe caller's IAM permissionsGetSecretValue

Today's keythe version everyone usesAWSCURRENT

The new key, being triedthe version being testedAWSPENDING

Yesterday's key in the drawerthe last version known to workAWSPREVIOUS

Changing the locks at nightnew credentials on a scheduleRotation

How it works

Store, grant, read, rotate

Store the secretIt is encrypted under a KMS key: aws/secretsmanager, or a customer managed key of your own.
Grant accessIAM policies decide which roles may read it.
Read it while runningThe application calls GetSecretValue and gets the current version.
Turn on rotationManaged rotation, or a Lambda function, changes the credentials on your schedule.

Most often: Every 4 hoursthe shortest schedule
Least often: Every 999 daysthe longest schedule
Window: 1 hour or morestarting on the hour, UTC
RDS master password: Every 7 daysRDS's default rotation
Recovery window: 7 days or morebefore a deletion is final
Encryption: KMSaws/secretsmanager by default

createSecret
A new version of the secret is made, holding a new password, and labelled AWSPENDING.
setSecret
The database or service is changed to accept the credentials in AWSPENDING.
testSecret
The AWSPENDING version is used to sign in, to show that it works.
finishSecret
AWSCURRENT moves to the new version, and the old one is labelled AWSPREVIOUS.

Pick a case to follow the rotation through each check.

Architecture

One password, read by every server

The app servers read the current password as they run; on schedule, a rotation function changes it in the database and in the secret.

The password lives in one place. Every app server reads it from Secrets Manager while it runs, so a rotation changes it for all of them at once.

Managed rotation needs no function. A secret managed by another service, such as the RDS master password, is rotated by that service. Otherwise a Lambda function does it, charged at Lambda's rates.

Replicas for other Regions. A secret can be copied to other Regions; rotating the primary updates the replicas, and a replica can be promoted to stand alone.

Security

Encrypted, controlled, recoverable

Encrypted with KMS. Each secret is protected by envelope encryption under a KMS key: aws/secretsmanager, or a customer managed key whose key policy you write.

IAM decides who reads it, and each read is an API call CloudTrail can record.

No person needs to see it. When RDS manages the master password, it is kept from human access and from plain-text view.

Deleting has a safety net. A deleted secret waits out a recovery window of at least 7 days and can be restored until then, unless you force deletion with no window at all.

Cost

How you are charged, not what it costs today

Per secret per month, each replica counting as a secret of its own.

Per 10,000 API calls.

Rotation by a Lambda function is charged at Lambda's rates.

Secrets marked for deletion are not charged. The aws/secretsmanager key is free; a customer managed key is charged as KMS charges it.

Prices change, so none are printed here. Check the Secrets Manager pricing page on aws.amazon.com.

Comparison

Where each kind of secret belongs

Service	Stores	Rotation	Charged	Choose it when
Secrets Manager	Credentials, API keys, tokens	Built in, on a schedule	Per secret, and per API call	Credentials that must change
Parameter Store	Strings, string lists, SecureStrings	None built in	Standard tier free, advanced charged	Configuration, and secrets that never rotate
KMS	Encryption keys	Key material, yearly by default	Per key, and per request	Encrypting data, never storing passwords

Parameter Store tier	Parameters	Largest value	Parameter policies
Standard	Up to 10,000	4 KB	No
Advanced	Up to 100,000	8 KB	Yes

What	Where AWS says to keep it
Database passwords and API keys	Secrets Manager
AWS credentials for your code	An IAM role
Encryption keys	KMS
SSH access to EC2	EC2 Instance Connect
TLS certificates	ACM

SAA traps

The phrase in the question, and what it means

rotate the database password automatically, with no application changesSecrets Manager

Applications read the current version while running, so a rotation needs no redeploy.

store configuration and simple secrets as cheaply as possible, no rotationParameter Store SecureString

Its standard tier is free, and it has no rotation built in.

credentials for an application on EC2 to call AWS APIsAn IAM role, not a secret

AWS recommends roles for AWS credentials, leaving nothing long-lived to store.

the same secret must be ready in a second Region for disaster recoveryReplicate the secret

Rotating the primary reaches its replicas, and a replica can be promoted.

rotate a secret every hourNot possible

The shortest rotation schedule is every four hours.

nobody may ever see the RDS master passwordLet RDS manage it in Secrets Manager

RDS generates it, stores it, and rotates it every seven days by default.

a secret was deleted by mistake yesterdayRestore it

It waits out a recovery window of at least 7 days before it is gone.

rotation failed, and now every attempt says one is already in progressAWSPENDING is left on another version

Until that is sorted out, each later rotation returns an error.

encrypt the secrets with a key the security team controlsA customer managed KMS key

The default is aws/secretsmanager; a customer managed key comes with a key policy you write.

Scenario

Exam style, marked when you answer

An application on EC2 connects to an RDS for MySQL database with a password kept in a configuration file. Auditors require the password to change every 30 days, without anyone seeing it and without redeploying the application. What should a solutions architect do?

Practice

Fill the gap, the way the challenges work

App servers in an Auto Scaling group sign in to a database with a password. The password must stay out of the code, be read by the servers as they run, and change automatically every 30 days with nothing redeployed. Where do the app servers get the password?

ALB· Load balancerEC2 Auto Scaling· App serversPick a service below

Quick revision

The night before the exam

What: Stores credentials; applications fetch them while running.
Rotation: Managed, or by a Lambda function; every 4 hours at most.
Labels: AWSCURRENT in use, AWSPENDING under test, AWSPREVIOUS kept.
Four steps: createSecret, setSecret, testSecret, finishSecret.
RDS: RDS can manage the master password, rotated every 7 days.
Replicas: Other Regions, kept current by rotation, promotable.
Deletion: A recovery window of at least 7 days.
Parameter Store: Cheaper, no rotation: configuration and simple secrets.

This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.

Checked against

Every fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.