Parameter Store vs Secrets Manager
~8 min read
Two related services for centralized configuration and secrets, differing mainly in automatic rotation support.
Systems Manager Parameter Store's Standard tier is free, supports String, StringList, and KMS-encrypted SecureString parameters, and is well suited to general application configuration and secrets that don't need automatic rotation — API keys, feature flags, connection strings that change infrequently and can be updated manually when needed.
AWS Secrets Manager is a related but separate service, purpose-built specifically for secrets requiring automatic rotation — it can be configured to automatically rotate a database credential on a schedule, coordinating with RDS/Aurora to update both the stored secret and the actual database password simultaneously, something Parameter Store has no built-in mechanism for. This capability comes at a real per-secret monthly cost, unlike Parameter Store's free Standard tier.
The practical guidance: use Parameter Store for general configuration and secrets that are fine being rotated manually (or infrequently); reach for Secrets Manager specifically when a secret's automatic, scheduled rotation is a genuine requirement — most commonly database credentials in security-conscious or compliance-driven environments.
💬 Deep Dive with AI
Key points
- •Parameter Store Standard: free, String/StringList/SecureString, no automatic rotation
- •Secrets Manager: paid per secret, purpose-built for automatic scheduled rotation, native RDS/Aurora integration
- •Use Parameter Store for general config and manually-managed secrets
- •Use Secrets Manager specifically when automatic rotation is a genuine requirement