- Sole purpose: store secrets
- Newer service than the SSM Parameters Store
- Has the capability to force the rotation of secrets every X days
- Has the capability to automate generation of secrets on rotation (uses Lambda for this)
- Secrets manager can be integrated with RDS (MySQL, PostgreSQL, Aurora) to synchronize secrets between databases and secrets manager
- Secrets are encrypted using KMS
- Mostly meant for RDS integration
- Pricing: $0.40 per secret per month / $0.05 per 10K API calls + 30 day free trial
- Stores key-value pairs for secrets
- Automatic rotation of secrets with AWS Lambda
- Direct integration with RDS, Redshift, DocumentDB
- KSM encryption is mandatory
- Can integrate with ClouDFormation
- In general a more expensive solution for storing secrets
- Has simple API
- Does not have secret rotation built-in (can be done manually)
- KMS encryption is optional
- Can integrate with CloudFormation
- We can pull a secret from Secrets Manager using the SSM Parameter Store API
- It is cheaper than the Secrets Manager