mrvitej.in

Archive · AWS

Secrets Manager and KMS

Store credentials safely, rotate them, and control the encryption keys behind them.

1 min read

  • AWS Secrets Manager
  • AWS KMS
  • AWS CLI 2.9

Do not put passwords in code, images or environment files in Git.

aws secretsmanager create-secret --name prod/shop/db \
  --secret-string '{"username":"app","password":"change-me"}' --region ap-south-1
aws secretsmanager get-secret-value --secret-id prod/shop/db --query SecretString --output text

In code, fetch the secret at start-up with the SDK, using the instance, task or Lambda role. Grant secretsmanager:GetSecretValue on that secret’s ARN only.

  • Rotation: Secrets Manager can rotate RDS credentials on a schedule using a Lambda function, so no one keeps a long-lived password.
  • Cost: about 0.40 USD per secret per month plus API calls. SSM Parameter Store SecureString is a cheaper option for simple configuration.
  • KMS: secrets and many AWS resources are encrypted with KMS keys. Use customer managed keys when you need your own key policy, audit trail and yearly rotation.

On Kubernetes, sync secrets in with the External Secrets Operator rather than committing them as manifests.