AWS Secrets Manager - Automatic Rotation and Application Integration
Automatically rotate RDS and Aurora passwords with Lambda functions and seamlessly retrieve secrets from applications using the SDK caching library. Also covers when to use Parameter Store instead.
Secrets Manager vs Systems Manager Parameter Store
Secrets Manager is a service for securely storing and managing sensitive information such as database passwords, API keys, and OAuth tokens. The biggest difference from the similar Systems Manager Parameter Store (SecureString) is the availability of automatic rotation. Secrets Manager provides a built-in mechanism for automatically rotating passwords for RDS, Aurora, Redshift, and DocumentDB using Lambda functions. Parameter Store is better suited for managing configuration values and feature flags, and offers a larger free tier compared to Secrets Manager's 0.40 USD per secret per month. The common approach is to use Secrets Manager for credentials that require automatic rotation and Parameter Store for other configuration values.
How Automatic Rotation Works
Automatic rotation is a mechanism where a Lambda function periodically updates the secret value. For RDS and Aurora, you can use AWS-provided Lambda rotation templates. Rotation executes in four steps: createSecret generates a new password, setSecret updates the database password, testSecret verifies connectivity with the new password, and finishSecret switches the secret's version label. Rotation intervals can be set from 1 to 365 days, with 30 or 90 days being common depending on security policy. To prevent downtime during rotation, the alternating users strategy (alternating between two database users) is recommended.
Retrieval Patterns from Applications
The basic pattern for retrieving secrets from applications is using the AWS SDK's GetSecretValue API. In Lambda functions, retrieve the secret during the initialization phase and cache it in a global variable to avoid API calls on every request. AWS-provided caching libraries (aws-secretsmanager-caching for Python, aws-secretsmanager-jdbc for Java) include TTL-based caching and automatic refresh during rotation. For ECS tasks, specifying the Secrets Manager ARN in the task definition's secrets field automatically injects the value as an environment variable at container startup. In CloudFormation templates, use dynamic references ({{resolve:secretsmanager:MySecret}}) to reference secrets without embedding their values directly in the template. For more on password management, you can also explore related books on Amazon.
Secrets Manager Pricing
Secrets Manager pricing consists of approximately 0.40 USD per secret per month and approximately 0.05 USD per 10,000 API calls. Lambda function execution costs for automatic rotation also apply, but given the rotation frequency (every 30-90 days), these are minimal. While more expensive than Parameter Store's SecureString (standard parameters are free), the value of automatic rotation should be factored into the decision. Use the Lambda caching library to reduce API call volume and optimize costs.
Summary
Secrets Manager is a service that automates the lifecycle management of credentials. By enforcing periodic password updates through automatic rotation, controlling access with IAM policies, and encrypting with KMS, it reduces the risk of credential leakage through multiple layers of defense. It eliminates the practice of embedding passwords in code or repositories and enables security best practices to be applied across the entire organization.