Choosing Between AWS Secrets Manager and Parameter Store

When managing application secrets, AWS offers two primary services: AWS Secrets Manager and SSM Parameter Store. While both provide encryption and secure storage, they cater to different needs and have distinct pricing structures.

SSM Parameter Store is generally the more cost-effective option for most applications. It's a part of AWS Systems Manager and is designed for configuration values in applications. For sensitive data, it uses the SecureString type, which encrypts the value using AWS KMS. For non-sensitive data, it offers String or StringList types. The standard tier of SSM Parameter Store is free, making it an economical choice for many use cases.

To write a secret to SSM Parameter Store, you can use a one-liner command. Reading back a secret requires the --with-decryption flag to decrypt the ciphertext. A benefit of SSM Parameter Store is its path-like naming structure, which allows for scoping IAM permissions to specific paths, ensuring that services only access the secrets they need.

While SSM Parameter Store and Secrets Manager both use KMS for encryption, Secrets Manager includes additional features such as automated Lambda function rotations and native integrations with databases like RDS and Redshift. However, these features come at a higher cost.

For secrets that don't require rotation, such as static API keys or third-party tokens, SSM Parameter Store is a more economical choice, offering the same security without the additional cost. Moreover, if you ever encounter size limits or need advanced parameter policies, SSM Parameter Store is likely to be cheaper than Secrets Manager.

However, both services have quotas and limits. Parameter Store, for instance, has a storage cap for SecureString parameters. It's crucial to group secrets logically to minimize the number of KMS decryption requests, which can incur additional charges. If you have a Lambda function or CI pipelines fetching multiple secrets, consider combining them into a single SecureString parameter. This reduces the number of decryption calls and simplifies management.

In conclusion, AWS Parameter Store is the go-to solution for most applications' secret management needs due to its cost-effectiveness and security. Reserve Secrets Manager for those specific cases where its advanced features justify the additional expense.