AWS Systems Manager Parameter Store vs AWS Secrets Manager - Choosing the Best Tool to Manage Sensitive Data

I recently faced this exact dilemma while working on a project, and let me tell you it wasn’t an easy choice! Both AWS Parameter Store and AWS Secrets Manager offer solid solutions for managing sensitive data like API keys, credentials, and configuration settings. But the differences? That’s where the real challenge lies.

I had to dig deep into the features, costs, and use cases of each to make the best call for my project. And after some serious testing and consideration, I finally landed on the right tool.

If you’re in the same boat, here’s what I learned from my experience—and which service came out on top for me.

AWS provides two powerful solutions for centralized storage and management of application configuration data and secrets. These services offer simple API interfaces for seamless integration and are designed to enhance security and streamline operations. Let’s explore these essential tools:

• Systems Manager Parameter Store: Aims for wider use cases, being used not only for secrets or passwords but also for application configuration variables.
• Secrets Manager: Designed specifically for confidential information that needs encryption capabilities, which is why this tool has encryption enabled by default when generating a new entry. Besides encryption, it offers additional functionality for secrets rotation.

Let’s explore some key questions that may help us decide which to pick.

Are they similar in any aspects?

These tools share some similarities, let’s categorize them:

Encryption

Both Secrets Manager and Parameter Store have the capability to utilize AWS Key Management Service (KMS) for encrypting data. By integrating KMS, IAM policies can be established to govern which IAM users and roles are authorized to decrypt the encrypted values. While IAM policies can effectively restrict access to these values, the use of encryption provides an additional layer of security and is often mandated to meet compliance requirements.

Key-Value store functionalities

Both services enable the storage of values under specific names or keys. They also support the use of key prefixes or any other prefix structure suited to the application’s needs. This feature is beneficial, as it allows the application deployment to reference different parameters or secrets based on the deployment environment.

IaC Integration

Infrastructure as Code (IaC) tools like Terraform or CloudFormation are common nowadays to leverage speed, avoid errors, and even document infrastructure delivery. However, storing secrets directly within these tools is considered a poor security practice. Instead, secrets (e.g., database usernames and passwords) should be stored in Parameter Store or Secrets Manager. These services can then be referenced within the IaC tool, thus allowing the template to point to the secrets without exposing them in plaintext.

Versioning

Both services support versioning of secret values. This allows you to view previous versions of your parameters or secrets in case you need them. You can choose to restore older versions of the parameters.

Parameter Store only allows one version of the parameter to be active at any given time.

Secrets Manager allows multiple versions to exist at the same time when you are performing a secret rotation using the staging labels.

What about their differences?

Parameter Store: This service comes in two flavors:

1. Standard parameters:

• There are no additional charges for storage or standard throughput.
• However, if higher throughput is required, API interactions are billed at $0.05 per 10,000 API calls.

2. Advanced parameters:

• Storage fee is $0.05 per parameter per month, in addition to the same $0.05 per 10,000 API calls for interactions.

Secrets Manager: This is a paid offering. The cost for storing secrets is $0.40 per secret per month, while API interactions are billed at $0.05 for every 10,000 API calls.

Do they offer any cool features?

Both offer great features, with Secrets Manager having some advantages out of the box, but many are achievable using Parameter Store, let’s explore these features:

Secret Size

Parameter Store:

• Standard Parameters: can store up to 4096 characters (4KB size) for each entry.
• Advanced Parameters: can store up to 8KB entries.

Secrets Manager: It can store up to 10KB secret size.

Limits

Parameter Store: It has a limitation of storing 10,000 standard parameters per region per account.

Secrets Manager: It has a limitation of storing 500,000 secrets per region per account.

Secret rotation

Parameter Store: We have to write our own function that updates credentials managed by Parameter Store and invoke it via a CloudWatch scheduled event or EventBridge.

Secrets Manager: It offers the ability to switch secrets at any given time and can be configured to regularly rotate depending on your requirements. It provides full key rotation integration with a few AWS services like RDS, Redshift, and DocumentDB. For other services, AWS allows you to write custom key rotation logic using an AWS Lambda function.

Cross-account Access

Parameter Store: Not supported out of the box.

Secrets Manager: Secrets can be accessed from another AWS account. It’s easier to share the secrets cross-accounts. This is useful if secrets are centrally managed from another AWS account or beneficial for use cases where a customer needs to share a particular secret with a partner.

Multiple Regions Replication

Parameter Store: It doesn’t support cross-region replication out of the box.

Secrets Manager: It lets you easily replicate your secrets in multiple AWS Regions to support applications spread across those Regions as well as disaster recovery scenarios.

Still in doubt on which you should pick?

Choose Parameter Store if

You want a cheaper option to store encrypted or unencrypted secrets and are not afraid of building features supported by default on Secrets Manager in exchange for cost savings.

Choose Secrets Manager if

You want to store only encrypted values and need a super easy way to manage the rotation of secrets. For instance, for organizations that have to be PCI compliant where the mandate is to rotate passwords every 90 days, AWS Secrets Manager makes that a very easy and seamless process.

This table would be helpful when deciding which to pick

Functionality	Parameter Store	Secrets Manager	Description
Encryption at rest	✅	✅	AWS KMS
Encryption in transit	✅	✅	TLS
Strong IAM based ACLs	✅	✅	Access controls applied using IAM
Audit logs via CloudTrail	✅	✅	Captures API calls
Developer Experience	✅	✅	Delivers full dev experience features
Works on-premises	✅	✅	Using AWS API endpoints
Parameter Versioning	✅	✅	Previous versions are saved
Password rotation		✅	Automatically rotates passwords
VPC endpoint	✅	✅	Private connectivity (PrivateLink)
Size limit	✅	✅	Secret Manager = 64KB & Parameter Store = 4-8KBs
TTL		✅	Time to Live for params or secrets
Cross region support		✅	Secrets can be replicated across regions
CloudFormation support	✅	✅	Can be managed using this tool
Terraform support	✅	✅	Can be managed using this tool
Tagging	✅	✅	Allow to group secrets/parameter
Secret hierarchy	✅		Path structure, ex; /app/db/pwd
Compliance Standards	SOC, PCI, FedRAMP, HIPA, others....	HIPPA, PCI, ISO, AICPA, FedRAMP, IRAP, OSPAR…	Compliance standards supported by default.
Pricing	free on standard parameters	$0.4 per secret and $0.05 per 10k API calls	May vary, consult pricing pages.

Summary

Both are great solutions for storing confidential secrets, license codes, application settings, environmental configurations for applications, IaC configuration secrets and more.

Secrets Manager gets ahead due to its built-in features, ease of use, and by-default encryption. However, it is completely achievable to build these features within Parameter Store by using a mix of AWS services and dedicating some time for coding, maintenance and troubleshooting.At the end of the day, the choice between these services really depends on your time to delivery, out-of-the-box compliance needs, and project budget to make a decision between the two.