AWS Secrets Manager Multi-Region Strategy - Replication and Cross-Account Sharing
Learn how to achieve disaster recovery with multi-region replication and build centralized management from a security account using cross-account access.
Multi-Region Secrets
Secrets Manager's multi-region secrets feature automatically synchronizes a primary region's secret to up to four replica regions. Each replica has its own ARN but can be accessed using the same secret name. Applications retrieve secrets from region-specific endpoints, so if the primary region fails, they can continue accessing secrets from a replica region. Replicas are read-only, and updates can only be made in the primary region. In the event of a primary region failure, you can promote a replica to primary to enable writes.
Cross-Account Access
In multi-account environments, the recommended approach is to manage secrets in a central security account and reference them from workload accounts. Configure a resource-based policy on the secret to allow GetSecretValue for IAM roles in workload accounts. On the workload account side, attach a policy to the IAM role granting access to the secret ARN in the security account. You also need to configure cross-account Decrypt permissions in the KMS key policy. This setup centralizes secret management while allowing applications in each account to access secrets securely.
Versioning and Availability During Rotation
Secrets Manager manages secret versions using labels. AWSCURRENT points to the currently active version, and AWSPREVIOUS points to the immediately preceding version. During rotation, a new password is created with the AWSPENDING label, and after the database password update and connection test succeed, it is promoted to AWSCURRENT. The alternating users strategy uses two database users alternately, maintaining connectivity through one user while the other's password is being rotated. On the application side, using the SDK's caching library is recommended - it continues using the pre-rotation password within the cache TTL and retrieves the new password when the TTL expires. To deepen your understanding of multi-region architectures, specialized books on Amazon can also be helpful.
Secrets Manager Pricing
Secrets Manager pricing consists of approximately 0.40 USD per secret per month and approximately 0.05 USD per 10,000 API calls. Multi-region replication incurs the same monthly fee for secrets in each replica region. Replicating to 4 regions costs approximately 2.00 USD per secret per month (0.40 x 5 regions). While this is more expensive than Parameter Store's SecureString (standard parameters are free), the value of automatic rotation and multi-region replication should be factored into the decision.
Summary
Secrets Manager's multi-region replication and cross-account sharing enable enterprise-scale secret management. By combining replica placement for disaster recovery, centralized management in a security account, and availability during rotation through versioning, you can build a robust secret management foundation.