Secrets Management
Data ProtectionSecrets Management is the practice of storing, distributing, and rotating sensitive credentials - database passwords, API keys, OAuth tokens, SSH keys - in a dedicated secure store instead of hardcoding them in application code or configuration files.
AWS Options
- AWS Secrets Manager: purpose-built; automatic rotation for RDS, Redshift, DocumentDB; cross-account sharing; $0.40/secret/month
- SSM Parameter Store (SecureString): simpler; KMS encryption; free for standard parameters; no built-in rotation
- HashiCorp Vault: self-hosted or HCP; dynamic secrets; multi-cloud; more operational overhead
Related Terms
A long-term credential pair (access key ID + secret access key) used to authenticate programmatic requests to AWS. Should be replaced with IAM roles wherever possible.
The practice of regularly replacing access keys, passwords, and secrets with new values to limit the window of exposure if a credential is compromised.
Protecting stored data by encrypting it on disk so that it cannot be read without the encryption key, even if the storage media is compromised.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.