AWS Secrets Manager - Automatic Rotation and Application Integration
Automatically rotate RDS and Aurora passwords with Lambda functions and seamlessly retrieve secrets from applications using the SDK caching library. Also covers when to use Parameter Store instead.
Secrets Manager vs Systems Manager Parameter Store
Secrets Manager is a service for securely storing and managing sensitive information such as database passwords, API keys, and OAuth tokens. The biggest difference from the similar service Systems Manager Parameter Store (SecureString) is whether automatic rotation is available. Secrets Manager provides, as a standard feature, a mechanism that automatically rotates passwords for RDS, Aurora, Redshift, and DocumentDB with Lambda functions. Parameter Store is suited to managing configuration values and flags, and has the advantage of a large free tier compared with Secrets Manager, which costs 0.40 USD per month per secret (as of August 2026). A common way to divide them is Secrets Manager for credentials that need automatic rotation and Parameter Store for other configuration values.
How Automatic Rotation Works
Automatic rotation is a mechanism where a Lambda function periodically updates the secret value. For RDS and Aurora, you can use AWS-provided Lambda rotation templates. Rotation executes in four steps: createSecret generates a new password, setSecret updates the database password, testSecret verifies connectivity with the new password, and finishSecret switches the secret's version label. Rotation intervals can be set from 1 to 365 days, with 30 or 90 days being common depending on security policy. To prevent downtime during rotation, the alternating users strategy (alternating between two database users) is recommended.
Retrieval Patterns from Applications
The basic pattern for retrieving secrets from applications is using the AWS SDK's GetSecretValue API. In Lambda functions, retrieve the secret during the initialization phase and cache it in a global variable to avoid API calls on every request. AWS-provided caching libraries (aws-secretsmanager-caching for Python, aws-secretsmanager-jdbc for Java) include TTL-based caching and automatic refresh during rotation. For ECS tasks, specifying the Secrets Manager ARN in the task definition's secrets field automatically injects the value as an environment variable at container startup. In CloudFormation templates, use dynamic references ({{resolve:secretsmanager:MySecret}}) to reference secrets without embedding their values directly in the template.
Secrets Manager Pricing
Secrets Manager pricing is approximately 0.40 USD per month per secret and approximately 0.05 USD per 10,000 API calls. Execution charges also apply to the Lambda function for automatic rotation, but given the rotation frequency (every 30 to 90 days), the amount is small. Secrets Manager costs more than Parameter Store's SecureString (standard parameters are free), but choose it in light of the value of the automatic rotation feature. Reduce the number of API calls with the Lambda caching library and optimize costs.
Rotation Design in Practice
Automatic secret rotation is a mechanism that periodically updates credentials and limits the risk if they are leaked. It is often used for items such as database passwords, and Lambda functions handle the rotation processing. For common configurations that work with databases, you can use predefined rotation functionality, but for your own systems you implement your own rotation processing. To keep the application from failing authentication even during an update, a strategy that temporarily keeps old and new credentials side by side is sometimes used. It is important to design the rotation frequency and method so that the system's requirements and updates without downtime can both be satisfied.
Cross-Account Sharing
In systems that span multiple accounts, there are situations where you want to share the same secret. Secrets Manager can use resource-based policies to allow access from specific other accounts. This removes the need to manage the same credentials in duplicate in each account, and lets you centralize updates. When sharing, also design the permissions for the key used for encryption so that only the allowed accounts can decrypt. Narrow the scope of allowed access to the minimum and avoid unnecessary sharing. Combining centralized management with appropriate sharing lets you operate credentials securely across the entire distributed system.
Security Best Practices
To handle secrets securely, follow several principles thoroughly. Grant access permissions for secrets only to the roles that truly need them, with the minimum scope. Manage the keys used for encryption at rest properly, and control who can decrypt. If you record who retrieved which secret and when so that it can be audited, you can detect suspicious access. Do not write credentials directly into code or configuration files; always design for retrieval at runtime. Combining these blocks the paths through which credentials leak and achieves robust management that can limit the scope of impact even if something goes wrong.
Retrieval Optimization and Operational Monitoring
When an application retrieves secrets frequently, API calls increase, affecting latency and cost. If you cache retrieved values for a certain period and reuse them, you can reduce the number of calls. Design the cache to be updated appropriately when rotation updates the value. On the operations side, it is important to monitor whether the rotation process is failing. If you continue operating with old credentials without noticing a failure, there is a risk that authentication errors occur at some point. Having a system in place that tracks the success or failure of rotation through notifications and allows an immediate response to failures leads to stable operations.
Summary
Secrets Manager is a service that automates the lifecycle management of credentials. By enforcing periodic password updates through automatic rotation, controlling access with IAM policies, and encrypting with KMS, it reduces the risk of credential leakage through multiple layers of defense. It eliminates the practice of embedding passwords in code or repositories and enables security best practices to be applied across the entire organization.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- AWS Secrets Manager official page
- AWS Lambda official page
- AWS KMS official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.