AWS Secrets Manager vs Parameter Store: The Actual Decision

Choosing between AWS Secrets Manager and AWS Systems Manager (SSM) Parameter Store is a common point of confusion for cloud engineers. Both services allow you to store sensitive data like database passwords, API keys, and license codes. Both integrate with AWS Identity and Access Management (IAM) for access control. Both support encryption using AWS Key Management Service (KMS).

However, treating them as interchangeable leads to unexpected costs, security gaps, and operational debt. The decision is not about which is "better," but which fits the mechanism required by your data's lifecycle.

The Core Mechanism: Vault vs. Database

To understand the difference, you must look at what these services actually are under the hood.

SSM Parameter Store is fundamentally a hierarchical key-value store. It is designed for configuration data. When you store a parameter, you are essentially writing to a distributed database that organizes data in a path structure, similar to a file system: /app/my-service/db-password. It is optimized for low-latency reads of configuration values during application startup or runtime. It does not inherently understand the concept of a "secret" needing rotation or audit trails beyond standard CloudTrail logs for API access.

AWS Secrets Manager is a dedicated secret management service. It is designed specifically for credentials that change frequently and require strict auditing. It treats every stored item as a secret object with metadata, versioning, and lifecycle policies. It is optimized for secure retrieval and integration with services that need to rotate credentials automatically, such as Amazon RDS or Amazon Redshift.

The key distinction: Parameter Store is a storage layer for configuration; Secrets Manager is a management layer for credentials.

Cost: The Hidden Trap

Cost is often the primary driver for choosing Parameter Store, but the calculation is nuanced.

SSM Parameter Store offers two tiers:

• Standard: No monthly storage fee, and standard-throughput API requests (GetParameters, GetParameter) are also free. You only pay $0.05 per 10,000 API requests if you opt into higher throughput.
• Advanced: $0.05 per parameter per month. This tier offers higher throughput, larger parameter sizes (up to 8 KB), and parameter policies such as expiration notifications.

AWS Secrets Manager charges:

• $0.40 per secret per month.
• $0.05 per 10,000 API requests.

Consider a scenario where you have 100 microservices, each requiring one database password and five environment variables (e.g., DB_HOST, CACHE_URL).

If you store all 100 database passwords and 500 environment variables in Parameter Store (Standard tier), storage and standard-throughput reads are free. Only if you opt into higher throughput for high-traffic applications do API costs apply, and even then they typically remain lower than Secrets Manager's storage fees for large inventories.

If you store the same 100 database passwords in Secrets Manager, you pay $40/month for the secrets alone, plus API costs. The 500 environment variables should not be in Secrets Manager; they belong in Parameter Store.

Opinion: Do not use Secrets Manager for static configuration. Use it only for credentials that require rotation or have a high cost-of-compromise profile. The cost delta becomes significant at scale. For 1,000 secrets, you are paying $400/month plus API costs. If those secrets don't rotate, you are paying for a feature you aren't using.

Rotation: The Defining Feature

The name "Secrets Manager" is not marketing fluff. It refers to the service's ability to manage the lifecycle of a secret, particularly rotation.

Automatic Rotation: Secrets Manager integrates natively with AWS Lambda. You can enable rotation for supported services (RDS, Redshift, DocumentDB) with a few clicks. Secrets Manager automatically creates a Lambda function that rotates the credential according to a schedule (e.g., every 30 days). It handles the old password, the new password, and the versioning. If you use Parameter Store, you must build this Lambda function yourself. You must manage the IAM roles, the rotation logic, the error handling, and the scheduling. This is operational overhead that most teams underestimate.

Manual Rotation: For non-RDS secrets (like an API key for a third-party service), Secrets Manager provides a structured way to version secrets. However, the AWSCURRENT and AWSPENDING states are not automatically managed by AWS for arbitrary secrets; they require a custom Lambda rotation function to implement this workflow. When you update a secret via the console or CLI, Secrets Manager creates a new version automatically. In Parameter Store, you simply overwrite the parameter value. While Parameter Store does maintain version history (tracked via VersionId) for every update, it lacks the explicit lifecycle states and automatic rollback mechanisms found in Secrets Manager. If a rotation fails in Parameter Store, you have no easy way to roll back to the previous value without manual intervention using the version ID.

Security and Access Control

Both services use IAM for access control. You can grant fine-grained permissions to specific parameters or secrets. However, the granularity and intent differ.

Parameter Store: You grant permissions like ssm:GetParameter. This action retrieves the value of a parameter. The policy is straightforward. You can restrict access to specific paths (e.g., /prod/db/*).

Secrets Manager: You grant permissions like secretsmanager:GetSecretValue. This action retrieves the secret value. Secrets Manager also supports resource-level permissions more explicitly for secret-specific actions, such as secretsmanager:RotateSecret or secretsmanager:PutSecretValue.

Encryption: Both services encrypt data at rest using KMS keys. By default, they use an AWS managed key, but you should use a customer-managed key (CMK) for both to maintain control over the encryption lifecycle. The security model is comparable at rest.

Audit Trails: Both services log API calls to CloudTrail. However, Secrets Manager's integration with CloudTrail is more focused on secret-specific events (creation, rotation, deletion). Parameter Store logs are generic API calls. For compliance-heavy environments (PCI-DSS, HIPAA), Secrets Manager provides a clearer audit trail of secret usage and rotation events.

Decision Framework

Use this flowchart to decide:

1. Is the data a credential that changes frequently (e.g., database password, API key)?

   • Yes -> Secrets Manager. The cost of rotation automation and versioning is justified.
   • No -> Go to 2.

2. Is the data configuration that changes rarely (e.g., endpoint URL, feature flag)?

   • Yes -> Parameter Store. It is free to store and simple to access.

3. Do you need to rotate the credential manually?

   • Yes -> Secrets Manager. It provides versioning and pending states via custom Lambda.
   • No -> Parameter Store is acceptable, but consider if the risk of a static credential being compromised outweighs the cost savings.

Conclusion

AWS Secrets Manager and SSM Parameter Store are not competitors; they are complementary tools. Parameter Store is your configuration database. Secrets Manager is your credential vault.

Do not use Parameter Store for secrets that require rotation. The operational burden of building and maintaining custom rotation logic will exceed the $0.40/month cost of Secrets Manager. Do not use Secrets Manager for static configuration. You will pay for a feature you don't need, and you will clutter your secret management dashboard with noise.

The right choice depends on the mechanism of your data's lifecycle. If it rotates, it belongs in Secrets Manager. If it configures, it belongs in Parameter Store.

FAQ

Can I use Parameter Store for secrets? Yes, you can store secrets in Parameter Store. However, you lose out on automated rotation, explicit versioning states (AWSCURRENT/AWSPENDING), and potentially clearer audit trails for compliance. It is generally recommended only for static secrets where the operational cost of managing rotation outweighs the benefits.

Is Secrets Manager free? No. Secrets Manager charges $0.40 per secret per month, plus API request costs. Parameter Store Standard is free to store parameters, and standard-throughput API requests are also free; charges only apply if you opt into higher throughput.

Does Parameter Store have versioning? Yes, Parameter Store maintains a version history for every update, accessible via the VersionId. However, it does not have the built-in lifecycle states (like AWSPENDING) that Secrets Manager uses to facilitate zero-downtime rotations.

Which service has better encryption? Both services offer strong encryption at rest using AWS KMS. You can use AWS managed keys or bring your own Customer Managed Keys (CMK) for both services. The encryption capabilities are comparable.

Common Pitfalls

1. Using Secrets Manager for Static Config: Storing static environment variables or feature flags in Secrets Manager incurs unnecessary monthly costs ($0.40/secret) without providing any rotational benefit.
2. Ignoring SSM API Costs: Assuming Parameter Store is "free" can lead to budget surprises. High-frequency reads (e.g., every second) in a large-scale application can generate significant API costs in the Standard tier.
3. Manual Rotation Complexity: Attempting to manage manual rotation for multiple secrets in Parameter Store often leads to inconsistent processes, lost version history, and increased risk of human error compared to the structured workflow of Secrets Manager.
4. Overlooking IAM Granularity: Failing to restrict IAM policies to specific parameter paths or secrets can lead to excessive permissions, violating the principle of least privilege.

Practical Takeaways

• Rule of Thumb: If it rotates, use Secrets Manager. If it configures, use Parameter Store.
• Cost Check: For static secrets, Parameter Store is usually cheaper. For rotating secrets, Secrets Manager saves engineering time, which often outweighs the $0.40/month fee.
• Security Posture: Secrets Manager provides a more robust framework for auditing and compliance due to its explicit lifecycle management and integration with CloudTrail for secret-specific events.