AWS Secrets Manager vs. SSM Parameter Store – SAP-C02 Study Guide | AWS Systems Architect Professional

Study guide

Technical reference and lesson notes

Purpose of This Lesson

AWS Secrets Manager securely stores sensitive application data such as database usernames, passwords, API keys, and connection details. Its most important distinction from AWS Systems Manager Parameter Store is built-in secret-value rotation for supported AWS services.

For the AWS Certified Solutions Architect – Professional exam, the decision usually involves choosing between Secrets Manager and Parameter Store based on rotation requirements, data size, hierarchy, encryption, and cost.

Key Concepts

AWS Secrets Manager

Secrets Manager is designed specifically for sensitive information that applications must retrieve securely at runtime. Common examples include:

Database credentials
API credentials
Service passwords
Connection strings containing confidential values

Secrets are encrypted using AWS KMS. Applications and automation require IAM permissions to retrieve or modify them.

Automatic Secret Rotation

Secrets Manager provides managed rotation workflows for supported services, including:

Amazon RDS database engines
Amazon Redshift
Amazon DocumentDB

Rotation changes the secret value, such as a database password, and updates the target service so applications can continue authenticating. Rotation is not the same as rotating the KMS encryption key used to encrypt the secret.

For unsupported services, implement a custom rotation workflow, commonly using AWS Lambda. The custom workflow must update both the external system and the corresponding Secrets Manager value safely.

A typical architecture is:

An application or Lambda function requests a secret using its IAM role.
Secrets Manager returns the decrypted value if the caller is authorized.
The application uses the value to authenticate to a database or service.
A scheduled rotation workflow changes the credential when required.

AWS Systems Manager Parameter Store

Parameter Store stores configuration values and secrets as parameters. It supports several parameter types:

String
StringList
SecureString, encrypted with AWS KMS

Parameter Store supports hierarchical names such as /production/orders/database/password. This makes it useful for organizing configuration by environment, application, or component.

Parameter Store does not provide native managed secret rotation. Rotation requires a custom process, such as a scheduled Lambda function, regardless of whether the value is stored as a SecureString.

Storage and Encryption Comparison

Capability	Secrets Manager	Parameter Store
Primary purpose	Secrets and credential lifecycle management	Configuration and parameter storage, including secrets
Value types	String or binary	String, StringList, or SecureString
Maximum value size	Up to 64 KB	Standard parameters up to 4 KB; advanced parameters up to 8 KB
KMS encryption	Always encrypted with KMS	Optional through `SecureString`
Managed rotation	Available for supported services	Not natively available
Custom rotation	Usually implemented with Lambda for unsupported services	Required for rotation workflows
Hierarchical names	Not supported as a native hierarchy	Supported
Pricing model	Charged per secret and API usage	Standard tier has different pricing characteristics; advanced parameters and higher throughput incur charges

Exam-Relevant Takeaways

Choose Secrets Manager when the requirement includes managed rotation of database or service credentials.
Choose Parameter Store for centralized configuration, especially when hierarchical parameter names are useful and native rotation is unnecessary.
Secrets Manager supports values up to 64 KB.
Parameter Store standard parameters support values up to 4 KB; advanced parameters support larger values, up to 8 KB.
SecureString parameters use KMS encryption, but encryption alone does not provide automatic credential rotation.
Secrets Manager uses KMS encryption for stored secret values.
Managed rotation is not universal. Confirm that the target service is supported before assuming Secrets Manager eliminates custom code.
For unsupported systems, a Lambda-based rotation process must update the credential in the target system and in Secrets Manager.
Do not confuse rotating a stored password with rotating the KMS key used to encrypt the stored value.

Architecture Decision Guide

Requirement	Recommended choice	Reason
RDS credentials must rotate automatically	Secrets Manager	Managed rotation workflows are available for supported RDS engines
Redshift or DocumentDB credentials require managed rotation	Secrets Manager	These services have supported rotation integrations
Application configuration is organized by environment and component	Parameter Store	Hierarchical parameter names are supported
Small, infrequently changed configuration values	Parameter Store	It is well suited to centralized configuration and may be more economical
Sensitive values larger than the Parameter Store limit	Secrets Manager	Supports values up to 64 KB
Unsupported third-party database requires rotation	Secrets Manager plus custom Lambda rotation	Secrets Manager stores the secret, while Lambda implements the integration
Encrypted configuration is needed but rotation is not	Parameter Store `SecureString`	Provides KMS-backed encryption without requiring Secrets Manager
Binary secret data must be stored	Secrets Manager	Supports string and binary secret values

Common Exam Traps

Assuming Secrets Manager automatically rotates every secret: Managed rotation applies only to supported integrations. Other systems require a custom Lambda rotation function.
Treating Parameter Store SecureString as equivalent to Secrets Manager rotation: KMS encryption protects the value at rest; it does not change the credential in the target system.
Confusing secret rotation with KMS key rotation: A database password can rotate while the KMS key remains unchanged.
Ignoring value-size limits: A requirement above Parameter Store limits may point to Secrets Manager.
Choosing Secrets Manager solely because the value is sensitive: Parameter Store can securely store sensitive values using SecureString. Rotation and lifecycle requirements are the differentiators.
Forgetting IAM access control: Applications still need permission to call Secrets Manager or Parameter Store APIs. Encryption does not automatically grant access.
Assuming hierarchical paths exist in Secrets Manager: Parameter Store has native hierarchical naming; Secrets Manager does not provide the same parameter hierarchy model.

Real-World Engineer Notes

Applications should retrieve secrets at runtime rather than embedding credentials in source code, container images, or deployment templates.
Grant workloads access through narrowly scoped IAM roles and restrict which secret names they can read.
Rotation requires application design. Components should tolerate credential changes and avoid caching a secret indefinitely.
A custom rotation Lambda must handle the complete lifecycle: create or generate a new credential, update the target service, validate it, and update the stored secret.
Use versioning and staged secret versions carefully during rotation so consumers do not switch to a value that has not been validated.
Consider network connectivity when rotation functions or applications run inside a VPC. They may need appropriate connectivity to Secrets Manager, KMS, and the target database.
Parameter Store is often the better fit for non-secret configuration such as feature flags, endpoints, and environment-specific settings. Use SecureString for confidential parameters.

Quick Reference Summary

Secrets Manager: purpose-built secret storage, KMS encryption, up to 64 KB, supported managed rotation, string or binary values.
Parameter Store: configuration and parameter storage, hierarchical names, String, StringList, and SecureString types.
Rotation: built into Secrets Manager only for supported services; custom Lambda logic is needed otherwise.
Encryption: Secrets Manager always uses KMS; Parameter Store uses KMS when the type is SecureString.
Selection rule: choose Secrets Manager for credential lifecycle and rotation; choose Parameter Store for organized configuration and simpler parameter storage.

Flashcards

Q: What is the primary purpose of AWS Secrets Manager?

A: Securely storing and managing sensitive values such as passwords, database credentials, and API keys.

Q: Which AWS services have supported Secrets Manager rotation integrations covered in this lesson?

A: Amazon RDS, Amazon Redshift, and Amazon DocumentDB.

Q: What is required to rotate credentials for an unsupported service?

A: A custom rotation workflow, commonly implemented with AWS Lambda.

Q: What is the maximum secret value size in Secrets Manager?

A: Up to 64 KB.

Q: What parameter type provides KMS encryption in Parameter Store?

A: SecureString.

Q: Does Parameter Store provide native automatic secret rotation?

A: No. A custom rotation process is required.

Q: Which service supports hierarchical names such as /prod/app/password?

A: Parameter Store.

Q: What value types does Secrets Manager support?

A: String and binary values.

Q: Is rotating a database password the same as rotating a KMS key?

A: No. Secret rotation changes the credential value; KMS key rotation changes the encryption key material.

Q: Which service is generally a better fit for centralized non-secret application configuration?

A: Parameter Store.

Practice Questions

Question 1

A company stores Amazon RDS credentials in a centralized service. Security policy requires the database password to change automatically every 30 days without building a custom rotation system. Which solution best meets the requirement?

A. Store the password as a Parameter Store SecureString
B. Store the password in Secrets Manager and configure managed rotation
C. Store the password in an encrypted S3 object
D. Store the password in AWS Systems Manager Parameter Store Advanced tier

Correct answer: B

Explanation: Secrets Manager provides managed rotation for supported Amazon RDS engines. Parameter Store encryption protects the value but does not provide native credential rotation.

Question 2

An application has environment-specific configuration values organized under paths such as /dev/orders/endpoint and /prod/orders/endpoint. The values do not require automatic rotation. Which service is the most appropriate choice?

A. AWS Secrets Manager
B. Amazon S3
C. Systems Manager Parameter Store
D. AWS Certificate Manager

Correct answer: C

Explanation: Parameter Store supports hierarchical parameter names and is suitable for centralized configuration. If a particular value is confidential, it can be stored as a SecureString.

Question 3

A company uses a third-party database that is not supported by Secrets Manager managed rotation. It requires credentials to rotate automatically. Which architecture should a solutions architect recommend?

A. Use Parameter Store SecureString; encryption automatically rotates the password
B. Use Secrets Manager with a custom AWS Lambda rotation function
C. Store the password in an encrypted EBS volume
D. Use an IAM access key instead of a database password

Correct answer: B

Explanation: Secrets Manager can store the credential, while a custom Lambda function implements the integration with the unsupported database and updates both the database and secret value.

Question 4

An application must store a confidential 20-KB value and retrieve it at runtime. It does not need hierarchical naming or automatic rotation. Which option best satisfies the storage requirement?

A. A standard Parameter Store parameter
B. A Parameter Store SecureString standard parameter
C. Secrets Manager
D. An environment variable in the application task definition

Correct answer: C

Explanation: A 20-KB value exceeds the 4-KB standard Parameter Store limit and is within the 64-KB Secrets Manager limit. Secrets Manager also encrypts stored values with KMS.

Question 5

A team claims that enabling KMS encryption on a Parameter Store parameter will automatically change the password in the target database on a schedule. What is the correct response?

A. Correct; KMS encryption includes credential rotation
B. Correct; this works only with advanced parameters
C. Incorrect; encryption protects the stored value, while rotation requires a custom workflow
D. Incorrect; Parameter Store cannot store passwords

Correct answer: C

Explanation: KMS encryption provides protection at rest and during authorized retrieval. It does not update credentials in an external database. Parameter Store requires a custom rotation process.