CI/CD Secrets (SSM vs Secrets Manager)

Hamza Rafique — Tue, 23 Jun 2026 09:48:18 +0000

Found a hardcoded DB password sitting in a CodeBuild pipeline last quarter.

It had been there 14 months. Nobody noticed.

This stuff happens more than people admit. And the fix is genuinely not complicated.

If something rotates — DB credentials, API keys, OAuth tokens — it goes in Secrets Manager. Full stop. Auto-rotation built in, native RDS integration, full audit trail in CloudTrail. Costs $0.40 a month per secret.

Everything else — feature flags, app config, environment values — SSM Parameter Store. Free tier. KMS encryption on SecureString. IAM controls per environment.

The thing most teams get wrong: they shove credentials into plain-text CodeBuild env vars because it's faster in the moment. Those values show up in build logs. Anybody with log access can read them.

One leaked key is all it takes. Uber found that out. Capital One found that out.

$0.40 a month versus a breach investigation. That's the actual tradeoff.

How does your team handle secrets in CI/CD right now? Curious if people are actually enforcing this or just saying they are.

Developer will need to understand lambda by 2026

Hamza Rafique — Sun, 31 May 2026 09:38:10 +0000

I used to deploy Node.js apps on EC2 and manage servers like it was my second job.

Port configs. PM2 restarts. Nginx rewrites. SSL renewals.

Then I ran my first AWS Lambda function.

80% of that work is gone.

Here's what Lambda actually does that nobody explains clearly:

→ You write a function
→ AWS runs it ONLY when triggered
→ You pay for milliseconds of execution
→ It scales from 1 to 1,000,000 requests without you touching anything

As a full-stack developer in Bahrain, preparing for my AWS Developer Associate exam, this is the shift that changes how you think about backend architecture.

Not "how do I manage a server" but "what should happen when this event fires."

That mental model switch took me a week to fully get.

I'm documenting everything as I study.

Drop a 🔥 if you want me to share my Lambda notes weekly.

DEV Community: Hamza Rafique

CI/CD Secrets (SSM vs Secrets Manager)

Developer will need to understand lambda by 2026