Technologies Secrets Manager

Secrets manager holds small bits of information you don't want accessed by prying eyes. This could mean passwords, your social security number, your credit cards, API Keys, or anything else text and smallish. I recommend against any personal information like SSN or CC #s, but it's possible and they are secret.

Secrets manager is really for Passwords and API keys. Things that your servers will need to operate and do their jobs, but you don't want to pass around from network device to network device while launching your app from source, esp. over open communication pathways.

The short version is that you give an acting service (i.e. EC2, RDS, Lambda) the permission to access a secret names MySQLAdminPassword and you give the same permissions to an API server to verify those credentials.

1. MySQL RDS Launches and has been instructed to look at the current "MySQLAdminPassword" secret for the admin credentials, receiving the decrypted value admin:strongpassword
2. EC2 launches and checks what the current "MySQLAdminPassword" secret to get credentials for its MySQL RDS, receiving the decrypted value admin:strongpassword
3. EC2 makes request to RDS successfully without storing your password in source code or git repos
4. After 2 weeks (or your set time, or never), Secrets manager automatically changes admin:strongpassword to admin:otherStrongPassword and both services automatically agree on the new password.

You can do the same idea with API keys for external services.

Pricing

Each secret is $0.40 Every 10k calls of that secret is $0.05

not too expensive, but still best to cache the secret on the server and update the cace every day/hour instead of asking for it every second. I am unsure if AWS does this caching automatically.