What is the difference between AWS Secrets Manager and Systems Manager Parameter Store?
Both store configuration securely. Secrets Manager is built for secrets, with automatic rotation for supported databases and a per-secret charge. Parameter Store is simpler, has a free standard tier, and can encrypt values with KMS as SecureString.
Explain it simply
Parameter Store is a notebook where you jot settings and can lock some pages. Secrets Manager is a bank locker service that also changes the lock's combination for you on a schedule. The locker costs more, but it does the rotating work.
Example
Secrets Manager Parameter Store
Main purpose : secrets (passwords, keys) configuration and secrets
Rotation : built-in, e.g. RDS none built-in (use your own Lambda)
Encryption : always, with KMS optional SecureString type
Cost : per secret per month + standard tier free,
per API call advanced tier has a charge
Cross-account : resource policy supported limited
Versioning : yes, staging labels yesTypical pattern: keep a database password in Secrets Manager with 30-day rotation, and keep non-secret settings like feature flags or an API URL in Parameter Store.
Applications fetch values at run time using their IAM role, so passwords never sit in code, environment files or AMIs. Both services are audited through CloudTrail.
What to say in the interview
"Secrets Manager is for secrets that need rotation and has a cost per secret. Parameter Store is cheaper and fine for configuration and simple encrypted values. I use Secrets Manager for database credentials and Parameter Store for general settings."
Common mistakes
- Hard-coding passwords in source code or environment files.