What is AWS secrets manager?

Every organization has to undertake effective management of secrets to keep its own, its clients’, and employees’ data safe. Keeping passwords, keys, and other secret data is crucial and difficult task. Recognizing this need, AWS offers a solution in the form of AWS secrets manager to address this challenge.

AWS secrets manager is a service provided by Amazon Web Services for IT and security administrators to store and retrieve secrets, such as API keys, passwords, etc, safely. Users can keep and manage their credentials and other secrets related to AWS cloud or even other third-party services using AWS secrets manager.

Features of AWS secrets manager

Here are some primary features of AWS secrets manager:

  • Data encryption: secrets manager uses Amazon Key Management Service (KMS) to encrypt data using encryption keys. The encrypted data can then be stored in a secure repository provided by secrets manager. This feature is handy for companies that have to deal with a large amount of customer information. For instance, a financial company must store sensitive customer information, such as banking credentials and credit card numbers, in the cloud. By using KMS, the company can encrypt this data and store it on AWS secrets manager.

  • Access management: With AWS secrets manager, users can control access to their secrets through IAM policies. It is generally a good practice to restrict access to secrets and specify who can access them and under what conditions. For instance, a software development company wants to securely manage access to API keys and database credentials used in their applications. Using AWS secrets manager access management capabilities, the team can control who can access the API keys and database credentials.

  • Automated rotation: With AWS secrets manager, users can automate the process of rotating their credentials for databases, API keys, etc, to increase security. The automated secrets rotation reduces the risk of security breaches as no outdated or compromised credentials are used for any service. For example, to improve security, an e-commerce platform rotates database credentials regularly and keeps client data in a relational database. The platform can automate the process of rotating these credentials on a schedule or in response to some events with AWS secrets manager’s automated rotation capability.

  • Secrets replication: AWS secrets manager allows secrets replication, making critical secrets available in multiple regions. It ensures consistent access to secrets in all areas. This feature is helpful in troubleshooting disasters. Consider a multinational corporation that uses several AWS regions to run distributed applications for high availability and disaster recovery. The company can use the secrets replication functionality of AWS secrets manager to provide consistent access to essential secrets, such encryption keys and API tokens, across all regions.

Working of AWS secrets manager

Here is the complete working of the AWS secrets manager in the form of an architecture diagram:

Working of AWS Secrets Manager
Working of AWS Secrets Manager

AWS secrets manager encrypts secrets using AWS KMS. When the secret is required by any application or Lambda function, it is fetched by secrets manager which decrypts the secret. This decrypted secrets is then used as the credentials to log into AWS RDS, redshift and other services. The record of the activity is maintained by AWS cloudtrail and AWS cloudwatch.

Integration of AWS secrets manager with Applications

To use AWS secrets manager with any application, we must create an Identity and Access Management (IAM) role and attach an IAM policy with it. This policy will allow the application to access the secrets. Once the policy is attached, we can hide the secrets in the application's source code. This can be done by replacing the plain text in the application with code. The code can be automatically retrieved using the secrets manager APIs.

To understand it further, consider a simple example where we create a secret and retrieve its value in our Python code. Run the code widget below to create a secret and retrieve its value.

import boto3
# Create a session with configured credentials
session = boto3.Session(
    aws_access_key_id=aws_access_key,
    aws_secret_access_key=aws_secret_key,
    region_name='us-east-1'
)
secretsmanager = session.client('secretsmanager')
secret_name = "answer-secret"
secret_value = "ABDVCOUGDEKBCDWBVLWWPP"  
try:
    response = secretsmanager.create_secret(
        Name=secret_name,
        Description="My simple secret created using Python",
        SecretString=secret_value
    )
    print("Secret created successfully:", response)
except:
    print(f"Error creating secret")
try:
    # Retrieve the secret value
    get_secret_value_response = secretsmanager.get_secret_value(
        SecretId=secret_name
    )
except:
    print("Error retrieving secret")
# Get the secret value
print(get_secret_value_response['SecretString'])

Code explanation

  • Line 1: import boto3

    • Imports the boto3 library, which is the AWS SDK for Python used to interact with AWS services.

  • Lines 4–8: Creates a boto3 session using the provided AWS credentials (aws_access_key and aws_secret_key) and sets the AWS region to 'us-east-1'.

  • Line 10: secretsmanager = session.client('secretsmanager')

    • This function initializes a client for AWS secrets manager using the created session. This client will be used to manage secrets.

  • Line 12: secret_name = "answer-secret"

    • Defines a variable for the name of the secret to be created.

  • Line 13: secret_value = "ABDVCOUGDEKBCDWBVLWWPP"

    • Defines a variable for the value of the secret.

  • Line 15: Starts a try block to handle potential exceptions during secret creation.

  • Lines 16–20: Attempts to create a new secret in AWS secrets manager with the specified name, description, and value.

  • Line 21: print("Secret created successfully:", response)

    • Prints a success message along with the response from AWS secrets manager if the secret creation is successful.

  • Line 22: except:

    • Catches any exceptions that occur during the try block.

  • Line 23: print(f"Error creating secret")

    • Prints an error message if there is an issue creating the secret.

  • Lines 27–28: Start another try block to handle potential exceptions during secret retrieval.

  • Lines 20-22: Attempts to retrieve the value of the secret using the name defined in secret_name.

  • Line 30: except:

    • Catches any exceptions that occur during the try block.

  • Line 31: print("Error retrieving secret")

    • Prints an error message if there was an issue retrieving the secret.

  • Line 34: print(get_secret_value_response['SecretString'])

    • Prints the value of the retrieved secret by accessing the SecretString key in the get_secret_value_response dictionary.

Conclusion

AWS secrets manager offers a secure platform for managing sensitive information, such as credentials, keys, passwords, and other secrets. It is a comprehensive suite that provides different services that can help users keep their secrets secure. For instance, users can encrypt and decrypt their passwords, manage access, and replicate their secrets. AWS secrets manager also provides centralized storage and seamless integration with other AWS services. It is a low-cost, scalable service, enabling organizations to keep their data safe.

Free AI Mock Interviews
Coding Interview
Coding PatternsFree Interview
Gain insights and practical experience with coding patterns through targeted MCQs and coding problems, designed to match and challenge your expertise level.
System Design
YouTubeFree Interview
Learn to design a video streaming platform like YouTube by tackling functional and non-functional requirements, core components, and high-level to detailed design challenges.

Free Resources

Copyright ©2025 Educative, Inc. All rights reserved