Security Specialty
AWS Secrets Manager vs Systems Manager Parameter Store: Which One Should You Use?
Use AWS Secrets Manager for secrets such as database credentials, API keys and tokens: it offers automatic rotation and cross-Region replication. Use Systems Manager Parameter Store for configuration data; its SecureString type encrypts values with AWS KMS.
Secrets Manager vs Parameter Store at a glance
| Feature | AWS Secrets Manager | Systems Manager Parameter Store |
|---|---|---|
| Purpose | Manage, retrieve and rotate database credentials, application credentials, OAuth tokens, API keys and other secrets throughout their lifecycles. | A centralized configuration data store for named values called parameters, such as text, lists of names, AMI IDs or license keys. |
| Value types | Secrets. | String, StringList and SecureString. |
| Rotation and replication | Purpose-built controls, including automatic rotation and cross-Region replication. | AWS recommends Secrets Manager when you need these controls for secrets. |
| AWS recommendation | Purpose-built for secrets such as database credentials, API keys and supported third-party secrets. | Good for configuration data. For credentials, usernames, passwords and other secrets, AWS recommends Secrets Manager. |
Source: docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html
Parameter Store encrypts SecureString values using AWS Key Management Service.
Sources: What is AWS Secrets Manager? and Systems Manager Parameter Store. The Parameter Store page also compares AWS AppConfig, which AWS lists for frequently changed application configuration.
Why not hard-code credentials?
Secrets Manager lets you replace hard-coded credentials in application source code with a runtime call that retrieves them when needed. Storing credentials outside the application avoids exposing them to anyone who can inspect your code or its components. With rotation, you replace long-term secrets with short-term ones, and rotating no longer requires redeploying your applications.
How rotation works in Secrets Manager
- Managed rotation: for most managed secrets, the service configures and runs rotation for you, without a Lambda function.
- Managed external secrets rotation: for secrets held by Secrets Manager partners, also without a Lambda function.
- Rotation by Lambda function: for other types of secrets, a Lambda function updates the secret and the database or service.
See Secrets Manager rotation notes in our data protection topic.
Exam shortcuts
- Automatically rotate database credentials → Secrets Manager.
- Store plain configuration such as endpoints or environment names → Parameter Store (String).
- Encrypt a stored value with a customer managed key → SecureString with KMS. Review AWS KMS notes.
- Remove credentials from application code → Secrets Manager runtime retrieval.
These appear under Domain 5, task 5.3.1 (design management and rotation of credentials and secrets). See Domain 5.
Frequently asked questions
Should I store database passwords in Parameter Store or Secrets Manager?
AWS recommends Secrets Manager for credentials such as usernames and passwords, because it is purpose-built for secrets and supports automatic rotation.
Does Parameter Store encrypt values?
Yes, with the SecureString type. Parameter Store encrypts those values using AWS Key Management Service.
Can Secrets Manager rotate secrets without Lambda?
Yes, for managed rotation and for managed external secrets. Other secrets use a Lambda function.
What is the third option AWS mentions for application data?
AWS AppConfig, which AWS lists for frequently changed application configuration.
Sources
- What is AWS Secrets Manager? (AWS)
- Systems Manager Parameter Store (AWS)
- Rotate AWS Secrets Manager secrets (AWS)
AWS updates its programs and documentation. Check the linked official pages for the latest details before you decide or pay.
Practice for your AWS exam
Free practice tests with instant explanations and spaced repetition. No sign-up.
Keep reading
- Security Specialty
KMS vs CloudHSM: Differences and When to Use Each
AWS KMS or AWS CloudHSM? Compare control, tenancy, FIPS validation and key management to choose the right option for the exam and for real workloads.
2 min read - Security Specialty
AWS Security Specialty Study Plan: A 4-Week Roadmap
A week-by-week SCS-C03 study plan built from the domain weights: what to read, what to practice and how to finish with a timed test.
3 min read - Security Specialty
SCS-C03 In-Scope AWS Services: The Official List
Every AWS service on the Security Specialty exam, grouped by category, plus what is out of scope and the concepts AWS says to know.
2 min read