AWS Secrets Manager
AWS Secrets Manager is AWS's managed service for storing and rotating secrets (API keys, passwords, certificates), launched in 2018. Secrets Manager provides automatic secret rotation, encryption at rest (KMS), IAM-based access control, and CloudTrail audit logging. As of October 2025, pricing is $0.40/secret/month + $0.05 per 10K API calls. For AI systems: Store LLM API keys, database credentials, encrypt secrets with KMS, rotate credentials automatically. Integrates natively with RDS, Redshift, DocumentDB for automatic credential rotation. Simpler than HashiCorp Vault but AWS-only. Alternative: AWS Systems Manager Parameter Store (free for standard parameters, $0.05 per advanced parameter).
Overview
Secrets Manager centrally stores secrets with KMS encryption, automatic rotation (7-90 days), and version tracking. Benefits: No hardcoded credentials, automatic rotation reduces exposure, IAM policies for fine-grained access, audit logs via CloudTrail. For AI: Store OpenAI/Anthropic keys, manage RDS credentials for training data, rotate database passwords automatically, use Lambda for custom rotation logic. Pricing: $0.40/secret/month + $0.05 per 10K API calls. 30-day free trial per secret. For high-volume access, consider caching secrets in application memory (refresh hourly).
Code Example
import boto3
import json
# Initialize client
client = boto3.client('secretsmanager', region_name='us-east-1')
# Store secret
client.create_secret(
Name='ai/openai-key',
SecretString=json.dumps({'api_key': 'sk-proj-...', 'org': 'org-...'})
)
# Retrieve secret
response = client.get_secret_value(SecretId='ai/openai-key')
secret = json.loads(response['SecretString'])
openai_key = secret['api_key']
# Use with OpenAI
from openai import OpenAI
openai_client = OpenAI(api_key=openai_key)
# Automatic rotation for RDS (AWS handles this)
client.rotate_secret(
SecretId='rds-postgres-creds',
RotationLambdaARN='arn:aws:lambda:us-east-1:123456789012:function:RotateRDS',
RotationRules={'AutomaticallyAfterDays': 30}
)Professional Integration Services by 21medien
21medien offers AWS Secrets Manager setup including secret migration, rotation configuration, IAM policy design, and application integration. Contact us for AWS secrets management consulting.
Resources
AWS Docs: https://docs.aws.amazon.com/secretsmanager | Pricing: https://aws.amazon.com/secrets-manager/pricing