Cheat Sheet: Secrets Manager vs Parameter Store

1. Service Overview

2. Key Features and Capabilities

2.1 Secrets Manager Exclusive Features

2.2 Parameter Store Features

2.3 Rotation Capabilities

3. Tier Comparison

3.1 Parameter Store Tiers

4. Access and Security

4.1 Access Control Methods

4.2 IAM Actions

4.2.1 Secrets Manager Key Actions

• secretsmanager:GetSecretValue - Retrieve secret value
• secretsmanager:DescribeSecret - Get metadata without secret value
• secretsmanager:CreateSecret - Create new secret
• secretsmanager:PutSecretValue - Update secret value
• secretsmanager:RotateSecret - Trigger rotation
• secretsmanager:UpdateSecret - Modify secret configuration
• secretsmanager:DeleteSecret - Delete secret (7-30 day recovery window)

4.2.2 Parameter Store Key Actions

• ssm:GetParameter - Retrieve single parameter
• ssm:GetParameters - Retrieve multiple parameters
• ssm:GetParametersByPath - Retrieve all parameters in a path
• ssm:PutParameter - Create or update parameter
• ssm:DeleteParameter - Delete parameter
• ssm:DescribeParameters - List parameter metadata
• ssm:GetParameterHistory - Retrieve parameter version history

5. Use Case Selection

5.1 When to Use Secrets Manager

• Database credentials requiring automatic rotation (RDS, DocumentDB, Redshift)
• API keys and OAuth tokens that need periodic rotation
• Secrets requiring cross-region replication for DR and multi-region deployments
• Applications needing built-in rotation without custom code
• Compliance requirements for automatic credential rotation
• Cross-account secret sharing using resource-based policies
• Secrets requiring fine-grained access control policies

5.2 When to Use Parameter Store

• Application configuration parameters (URLs, feature flags, settings)
• Non-sensitive data that changes frequently
• Cost-sensitive applications with many parameters (Standard tier is free)
• Hierarchical configuration management (environment-based paths)
• Integration with Systems Manager automation and patching
• Storing AMI IDs, instance types, and infrastructure parameters
• Simple secrets without rotation requirements
• Parameters requiring expiration policies and notifications (Advanced tier)

5.3 Decision Matrix

6. Integration Patterns

6.1 Application Integration

6.2 CloudFormation Dynamic References

7. Operational Considerations

7.1 Monitoring and Auditing

7.2 Best Practices

7.2.1 Secrets Manager

• Enable automatic rotation for all database credentials
• Use separate secrets per environment (dev, staging, prod)
• Implement least privilege IAM policies using secret ARNs
• Enable cross-region replication for critical secrets in multi-region architectures
• Use resource-based policies for cross-account access instead of sharing credentials
• Configure deletion recovery window (7-30 days) to prevent accidental loss
• Tag secrets for cost tracking and access control
• Cache secrets in application code; do not retrieve on every request

7.2.2 Parameter Store

• Use hierarchical naming (/app/environment/component/parameter)
• Store sensitive data as SecureString with KMS encryption
• Use Advanced tier for parameters requiring expiration policies
• Implement least privilege using path-based IAM policies
• Version parameters to track changes and enable rollback
• Use GetParametersByPath for bulk retrieval to reduce API calls
• Set up EventBridge rules to monitor parameter changes
• Tag parameters for cost allocation and organization

7.3 Performance Optimization

8. Cost Optimization

8.1 Cost Comparison Scenarios

8.2 Cost Reduction Strategies

• Use Parameter Store Standard tier for non-rotating secrets and configuration data
• Reserve Secrets Manager for credentials requiring automatic rotation
• Implement application-level caching to reduce API call charges
• Consolidate related secrets into single JSON secret (within 10 KB limit)
• Delete unused secrets to avoid monthly storage charges
• Use VPC endpoints to eliminate NAT Gateway data transfer costs

9. Limitations and Quotas

9.1 Service Limits

9.2 Cross-Region Considerations

10. Exam Key Points

10.1 Critical Differences

• Secrets Manager: Automatic rotation, cross-region replication, resource policies, higher cost
• Parameter Store: Hierarchical storage, free tier, parameter policies, integration with Systems Manager
• Rotation: Secrets Manager has built-in; Parameter Store requires custom Lambda implementation
• Cost: Parameter Store Standard tier is free; Secrets Manager charges per secret per month
• Size: Secrets Manager supports up to 64 KB; Parameter Store limited to 4 KB (Standard) or 8 KB (Advanced)

10.2 Common Exam Scenarios

10.3 Security Best Practices for Exam

• Always use KMS encryption for sensitive data in both services
• Implement least privilege IAM policies; grant access to specific secrets/parameters only
• Use VPC endpoints (PrivateLink) to keep traffic within VPC
• Enable CloudTrail logging for audit and compliance
• Use SecureString type in Parameter Store for any sensitive data
• Implement application-level caching to reduce API exposure
• Rotate database credentials using Secrets Manager automatic rotation
• Use separate secrets per environment to limit blast radius