AWS Secrets Management: Secrets Manager vs. SSM Parameter Store

Purpose of This Lesson

This lesson explains how to select between AWS Secrets Manager and AWS Systems Manager Parameter Store for storing passwords, database connection strings, license codes, configuration values, and other sensitive information. The central decision is whether the workload needs native secret rotation, hierarchical parameter organization, or lower-cost configuration storage.

Key Concepts

• AWS Secrets Manager stores secrets securely and supports credential rotation without requiring application code deployments.
• Secrets Manager provides built-in automatic rotation for certain services, including:
• Amazon RDS for MySQL, PostgreSQL, SQL Server, and Aurora engines
• Amazon Redshift
• Amazon DocumentDB
• For services without built-in rotation support, a custom AWS Lambda function can implement the rotation workflow.
• AWS Systems Manager Parameter Store, commonly called SSM Parameter Store, provides secure, hierarchical storage for configuration data and secrets.
• Parameter Store supports parameter values as:
• String for unencrypted text
• StringList for a list of strings
• SecureString for encrypted values
• Secrets Manager values use either string or binary formats and are always encrypted.
• Parameter Store parameters can be retrieved by the unique parameter name created for them.
• Parameter Store does not provide native key or credential rotation. Custom rotation can be built with Lambda.

Secret Storage and Application Access Patterns

Applications should retrieve sensitive values at runtime rather than embedding passwords or database connection strings in source code, deployment packages, or instance configuration.

A typical Secrets Manager pattern is:

1. A Lambda function needs to connect to a database.
2. The database connection string and password are stored in Secrets Manager.
3. Lambda retains only the information needed to call Secrets Manager.
4. Lambda retrieves the secret and uses it to connect to Amazon RDS.
5. Secrets Manager can rotate the credentials periodically when supported by the service or by a custom rotation Lambda function.

A similar Parameter Store pattern can be used with an EC2 instance and a database. The EC2 workload retrieves the required parameter values from SSM Parameter Store and uses them to connect to Amazon RDS.

The important security principle is to keep the credential value out of the application code while granting the workload permission to retrieve it at runtime.

Technical / Operational Context

AWS Secrets Manager

Secrets Manager is the stronger fit when the workload requires managed credential rotation. Rotation is built in for selected AWS database and data services. For other services, the rotation process must be implemented with a Lambda function.

Secrets Manager supports string and binary secret values, and its stored values are encrypted. Its pricing model charges per secret.

SSM Parameter Store

Parameter Store is designed for scalable, highly available, and durable storage of configuration data and secrets. Parameters can be organized hierarchically, which is useful for structuring values by application, environment, or other naming conventions.

Parameter Store supports both unencrypted and encrypted parameter types. Standard parameters are available without an additional charge, while advanced parameters incur charges based on the applicable usage model. Parameter Store does not natively rotate credentials.

Comparison Table

Capability	AWS Secrets Manager	SSM Parameter Store
Native rotation	Yes, for supported services	No
Custom rotation	Lambda can be used when built-in rotation is unavailable	Lambda can be used with custom code
Value types	String and binary	String, StringList, and SecureString
Encryption	Values are always encrypted	Depends on parameter type; SecureString is encrypted
Hierarchical organization	Not hierarchical	Supports hierarchical parameter names
Pricing model	Pay per secret	Standard tier is free; advanced tier is charged according to usage
Common use	Managed application credentials and rotating database secrets	Configuration values, license codes, and secrets organized by hierarchy

Exam- or Assessment-Relevant Takeaways

• If the scenario emphasizes automatic credential rotation, choose Secrets Manager.
• If the target service is RDS for MySQL, PostgreSQL, SQL Server, Aurora, Redshift, or DocumentDB, remember that Secrets Manager has built-in rotation support for these services.
• If a service is not supported by built-in rotation, Secrets Manager can still be used, but the rotation workflow requires a custom Lambda function.
• Do not assume Parameter Store rotates secrets automatically. It does not have native rotation; custom Lambda code is required.
• If the requirement is hierarchical storage for configuration values or secrets, Parameter Store is the relevant choice.
• If the question distinguishes SecureString from ordinary strings, SecureString is the encrypted Parameter Store type.
• Secrets Manager secrets are always encrypted, while Parameter Store can contain plain-text String values.
• Cost may influence the choice: standard Parameter Store parameters are free, whereas Secrets Manager charges per secret. Advanced Parameter Store parameters also incur charges.
• Both services can be accessed at runtime by applications such as Lambda and EC2 instead of hard-coding credentials.

Tool / Feature Decision Guide

Choose Secrets Manager when:

• Credentials need native automatic rotation.
• The secret is associated with a supported service such as RDS, Redshift, or DocumentDB.
• The application needs encrypted string or binary secret values.
• You want a managed rotation capability rather than building the full rotation process yourself.

Choose SSM Parameter Store when:

• You need hierarchical organization of configuration values or secrets.
• The values include configuration strings, license codes, or other parameters.
• Native secret rotation is not required.
• Standard-tier storage meets the requirement and cost sensitivity is important.
• The workload needs String, StringList, or SecureString parameter types.

Use custom Lambda rotation when:

• Secrets Manager does not provide built-in rotation for the target service.
• Parameter Store is being used but the application requires a custom rotation process.
• The team is prepared to implement and maintain the rotation code.

Common Traps / Misconceptions

• Trap: Parameter Store automatically rotates credentials. It does not. Rotation requires custom code, such as a Lambda function.
• Trap: Secrets Manager is required for every secret. Parameter Store can securely store secrets, including encrypted SecureString values, and is also useful for configuration data.
• Trap: All Parameter Store values are encrypted. Only encrypted parameter types such as SecureString provide encrypted storage; String values are plain text.
• Trap: Secrets Manager uses hierarchical parameter names. Hierarchical organization is a Parameter Store capability described in this lesson.
• Trap: Secrets Manager has built-in rotation for every service. Built-in rotation applies to selected services. Other services require a custom Lambda rotation function.
• Trap: Both services have the same pricing model. Secrets Manager charges per secret; standard Parameter Store is free, while advanced parameters are charged.

Real-World Engineer / Analyst Notes

• Treat runtime retrieval as an access-control problem: the workload needs permission to call the selected service, but it should not contain the secret value itself.
• Rotation is operationally more than changing a stored string. The application, target database or service, and retrieval workflow must continue to work with the updated credential.
• Use the service’s rotation support as a decision point. Built-in rotation reduces custom implementation work, while unsupported targets require a Lambda-based design.
• Separate configuration organization from credential lifecycle management. Parameter Store’s hierarchy helps manage values at scale; Secrets Manager’s major differentiator is managed secret rotation.
• When reviewing an architecture, identify whether a stored value is plain text, encrypted, or always encrypted before deciding that the storage approach satisfies the security requirement.

Quick Reference Summary

• Need native credential rotation? Use Secrets Manager.
• Need hierarchical configuration storage? Use SSM Parameter Store.
• Need encrypted Parameter Store values? Use SecureString.
• Need a list of values in Parameter Store? Use StringList.
• Need rotation for an unsupported service? Implement custom Lambda rotation.
• Secrets Manager value formats: string and binary; always encrypted.
• Parameter Store value formats: string, string list, and secure string.
• Cost distinction: Secrets Manager charges per secret; standard Parameter Store is free, while advanced parameters are charged.

Flashcards

Q: A database credential must rotate automatically, and the target is Amazon RDS for PostgreSQL. Which service is the natural choice?
A: AWS Secrets Manager, because it provides built-in automatic rotation for RDS PostgreSQL credentials.

Q: When would you choose SSM Parameter Store instead of Secrets Manager for a set of application settings?
A: Choose Parameter Store when hierarchical organization of configuration values is important and native credential rotation is not required.

Q: What is the decisive difference between Secrets Manager rotation and Parameter Store rotation?
A: Secrets Manager provides native rotation for selected services, while Parameter Store has no native rotation. Either service can use custom Lambda code when needed.

Q: An application must store an encrypted value in SSM Parameter Store. Which parameter type should it use?
A: SecureString, because it is the encrypted Parameter Store value type.

Q: What Parameter Store type is intended for an unencrypted text value?
A: String stores a plain-text value.

Q: Which Parameter Store type is appropriate for a list of values?
A: StringList.

Q: What value formats does Secrets Manager support according to this lesson?
A: Secrets Manager supports string and binary values, and its values are always encrypted.

Q: A service is not supported by Secrets Manager’s built-in rotation. What is the supported extension approach?
A: Use a custom AWS Lambda function to implement the rotation workflow.

Q: An EC2 instance needs a database password but the organization wants hierarchical names for environment-specific settings. Which service better matches the requirement?
A: SSM Parameter Store, because it supports hierarchical parameter organization. Use SecureString if the password must be encrypted.

Q: How does the basic pricing distinction affect a storage decision?
A: Secrets Manager charges per secret. Standard Parameter Store is free, while advanced Parameter Store parameters incur charges.

Q: What should an application store locally when retrieving a secret at runtime?
A: It should store only the information needed to call the secret service, not the password or connection string itself.

Q: What is the trap in assuming that every Secrets Manager secret rotates automatically?
A: Built-in rotation applies only to supported services; unsupported services require a custom Lambda rotation function.

Practice Questions

Question 1

A Lambda function connects to an Amazon Aurora database. The security requirement is to rotate the database credentials automatically without redeploying the function. Which option best fits?

A. Store the password as a plain-text Parameter Store String
B. Store the credentials in Secrets Manager and use its supported rotation capability
C. Store the credentials in a Parameter Store StringList
D. Hard-code the password in the Lambda deployment package

Correct answer: B

Explanation: Secrets Manager supports built-in rotation for Aurora, and runtime retrieval avoids embedding the credential in the function package.

Question 2

An organization needs to store environment-specific application configuration using names grouped by application and environment. Rotation is not required, and minimizing storage cost is important. Which choice is most appropriate?

A. Standard-tier SSM Parameter Store parameters
B. Secrets Manager binary secrets for every setting
C. A custom Lambda rotation function with no parameter storage
D. Plain-text values embedded in the application code

Correct answer: A

Explanation: Parameter Store supports hierarchical organization, and standard parameters are free according to the lesson. Sensitive values should use an encrypted parameter type rather than application code.

Question 3

A team wants to store a credential in SSM Parameter Store and assumes it will rotate automatically because the value is encrypted. What should the engineer explain?

A. Encryption automatically enables rotation
B. Parameter Store supports native rotation only for RDS
C. Parameter Store has no native rotation; custom Lambda code is required
D. Parameter Store cannot store credentials

Correct answer: C

Explanation: SecureString provides encrypted storage, but it does not provide native credential rotation. A custom Lambda workflow is needed for rotation.

Question 4

A workload uses a third-party service whose credentials must rotate periodically. The team wants to use AWS-managed secret storage but the service is not covered by built-in Secrets Manager rotation. Which design is supported?

A. Use Secrets Manager with a custom Lambda rotation function
B. Use a Parameter Store String and rely on automatic rotation
C. Use a Parameter Store hierarchy and assume hierarchy enables rotation
D. Store the credentials in an unencrypted Lambda environment variable

Correct answer: A

Explanation: Secrets Manager can support unsupported targets through a custom Lambda rotation function. Neither a Parameter Store hierarchy nor a plain string provides native rotation.

WordPress Metadata

Suggested Slug:
aws-secrets-manager-ssm-parameter-store-soa-c03

Meta Description:
Compare AWS Secrets Manager and Systems Manager Parameter Store for storing credentials, configuration data, rotation, encryption, hierarchy, and cost decisions in SOA-C03 scenarios.

Tags:
AWS Secrets Manager, SSM Parameter Store, AWS Systems Manager, secrets management, credential rotation, AWS Lambda, AWS RDS, SOA-C03