Skip to main content

AWS Secrets Manager Learning & Revision Guide

Overview​

AWS Secrets Manager is a managed service used to securely store, retrieve, and manage sensitive information such as database credentials, API keys, access tokens, and application secrets. It helps eliminate hardcoded credentials from applications and supports automatic secret rotation.

1. Secrets Management​

Secrets Manager provides centralized storage for sensitive information.

Key Topics​

  • Create and manage secrets
  • Store usernames and passwords
  • Store API keys and tokens
  • Store database credentials
  • Store application configuration secrets

Common Examples​

  • RDS username and password
  • Third-party API keys
  • OAuth tokens
  • Application secrets
  • Cross-account credentials

2. Secret Types​

Different types of sensitive information can be stored as secrets.

Key Topics​

  • Plain text secrets
  • Key-value pair secrets
  • JSON formatted secrets
  • Binary secrets

Example​

{
  "username": "admin",
  "password": "MySecurePassword"
}

3. Encryption with AWS KMS​

All secrets stored in Secrets Manager are encrypted using AWS Key Management Service (KMS).

Key Topics​

  • AWS managed KMS keys
  • Customer managed KMS keys (CMK)
  • Encryption at rest
  • Decryption permissions

Relationship Between Secrets Manager and KMS​

Application
      |
      v
Secrets Manager
      |
      v
KMS Key
      |
      v
Encrypted Secret

Important Concept​

Secrets Manager stores encrypted secrets, while KMS manages the encryption and decryption keys.

4. IAM Permissions​

IAM controls who can access secrets.

Key Topics​

  • IAM Users
  • IAM Roles
  • Resource Policies
  • Least Privilege Access

Common Permissions​

secretsmanager:GetSecretValue
secretsmanager:DescribeSecret
secretsmanager:ListSecrets

5. KMS Permissions​

In addition to Secrets Manager permissions, users and applications may require KMS permissions.

Common KMS Permissions​

kms:Decrypt
kms:Encrypt
kms:GenerateDataKey
kms:DescribeKey

Important Note​

Having permission to access a secret is not always sufficient. If a customer-managed KMS key is used, the application must also have permission to decrypt the secret using KMS.

6. Accessing Secrets from AWS Services​

AWS services can retrieve secrets securely without storing credentials in code.

Common Integrations​

  • AWS Lambda
  • Amazon ECS
  • Amazon EKS
  • EC2 Instances
  • AWS Glue
  • AWS CodeBuild

7. Lambda and Secrets Manager Integration​

A common production use case is storing database credentials in Secrets Manager and allowing Lambda to retrieve them at runtime.

Flow​

Lambda Function
      |
IAM Role
      |
Secrets Manager
      |
KMS Key
      |
Database Credentials

Required Permissions​

IAM Role:

secretsmanager:GetSecretValue
kms:Decrypt

This allows Lambda to securely retrieve and decrypt the secret during execution.

8. EC2 and Secrets Manager Integration​

Applications running on EC2 can access secrets using an IAM Role attached to the instance.

Flow​

EC2 Instance
      |
IAM Role
      |
Secrets Manager
      |
KMS Key

Benefits​

  • No hardcoded credentials
  • Centralized secret management
  • Enhanced security

9. Secret Rotation​

Secrets Manager supports automatic credential rotation.

Key Topics​

  • Automatic rotation
  • Manual rotation
  • Rotation schedules
  • Lambda-based rotation

Common Use Cases​

  • RDS database password rotation
  • Application credential rotation
  • Compliance requirements

10. Resource-Based Policies​

Resource policies allow cross-account access to secrets.

Key Topics​

  • Cross-account access
  • Account-level permissions
  • Shared secrets

11. Monitoring and Auditing​

Monitor secret access and usage.

Key Topics​

  • CloudTrail Logging
  • CloudWatch Metrics
  • Secret Access Auditing
  • Compliance Reporting

12. Security Best Practices​

  • Use IAM Roles instead of access keys.
  • Enable automatic secret rotation.
  • Use customer-managed KMS keys for sensitive workloads.
  • Follow least-privilege access principles.
  • Never store credentials in source code.
  • Monitor secret access through CloudTrail.

Revision Checklist​

Before considering Secrets Manager revision complete, ensure you understand:

  • Secret Creation and Management
  • Secret Types
  • IAM Permissions
  • KMS Integration
  • Encryption and Decryption Flow
  • Lambda Integration
  • EC2 Integration
  • Secret Rotation
  • Cross-Account Access
  • Resource Policies
  • Monitoring and Auditing
  • Security Best Practices

Most Important Interview Concept​

Understand the relationship between:

Application
   ↓
IAM Role
   ↓
Secrets Manager
   ↓
KMS Key
   ↓
Secret Value

If an application needs to retrieve a secret, it typically requires:

  • secretsmanager:GetSecretValue
  • kms:Decrypt

These permissions are usually granted through an IAM Role attached to the AWS service (Lambda, EC2, ECS, EKS, etc.).

For your AWS learning repository, I would place Secrets Manager under:

AWS
└── Security
    ├── IAM
    ├── KMS
    ├── Secrets Manager
    ├── ACM
    └── WAF

because Secrets Manager is tightly coupled with IAM and KMS in almost every real-world implementation.