AWS Secrets Manager

How AWS Secrets Manager works

In the context of AWS Secrets Manager, a secret is the confidential information that contains any sensitive data requiring protection, such as database credentials, API tokens, or SSH keys. When a secret is created AWS Secrets Manager encrypts that secret using a data key generated and managed by AWS Key Management Service (KMS). Upon retrieval the secret is decrypted and provided to the user in its original form.

Features of Secrets Manager

Let’s look at some of the features of the AWS Secrets Manager:

• Automatic rotation mechanism: AWS Secrets Manager supports an automatic rotation mechanism to update secrets with updated values to enhance security measures regularly.

• Version control: AWS Secrets Manager also incorporates version control, allowing us to store multiple versions of a secret. In the case of versioning, Secrets Manager keeps track of three specific secret versions, which are as follows:

  • AWSCURRENT: The current version

  • AWSPREVIOUS: The previous version

  • AWSPENDING: The pending version (during rotation)

• Multi-region Secrets Manager: AWS Secrets Manager supports multi-region replication of secrets, providing redundancy and ensuring high availability of sensitive data across different AWS regions. This feature enhances disaster recovery capabilities and ensures that applications can securely access secrets even during a regional outage or failure.

Best practices

Here are some recommended practices to keep in mind while utilizing AWS Secrets Manager:

• Monitor secrets: Keep track of secret usage and configure CloudWatch alarms to notify you of unusual or suspicious behavior.

• Automatic rotation schedule: Enable rotation of secrets in both the secret itself and the associated database or service.