CodeParkUse Secrets Manager for secrets that need rotation. Use Parameter Store for plain configuration and simple secrets, because it is cheap.
Secrets Manager is built for secrets. Its main feature is managed rotation: changing a password or key on a schedule.
- For RDS, Aurora and some other databases, AWS provides the rotation functions.
- For other credentials, you write your own Lambda.
It also:
- Replicates secrets across Regions.
- Supports resource policies for cross-account access.
- Integrates with RDS and RDS Proxy.
You pay per secret per month, plus per API call.
Parameter Store is a hierarchical store for configuration, with paths like /myapp/prod/featureX. SecureString parameters are encrypted with KMS. Standard parameters have no storage charge, so it is cheap for lots of config and simple secrets. It has no built-in rotation.
A common split:
- Secrets Manager: database credentials and third-party API keys that need rotation.
- Parameter Store: plain configuration and feature settings.
You access both through IAM, and CloudTrail records every access for audit.
- Secrets Manager gives managed rotation, cross-Region replication and cross-account policies.
- Secrets Manager costs money per secret and per API call.
- Parameter Store holds hierarchical config, encrypts SecureString values with KMS, and is cheap.
- Parameter Store has no built-in rotation.
- Both use IAM for access and CloudTrail for audit.