DEV Community: SANDHIYA N

S for Secrets Manager: Keeping Application Secrets Safe on AWS

SANDHIYA N — Tue, 15 Sep 2026 17:21:13 +0000

Introduction

Modern applications depend on many sensitive pieces of information such as database passwords, API keys, OAuth tokens, and application credentials. A common but unsafe practice is to store these credentials directly inside source code or configuration files. If the code is uploaded to GitHub or shared with other developers, these credentials may be exposed.

AWS Secrets Manager is an AWS service designed to securely store, manage, retrieve, and rotate sensitive information called secrets. Instead of hard-coding credentials inside an application, the application can request them from Secrets Manager when they are needed. This improves security and makes credential management easier.

What is AWS Secrets Manager?
AWS Secrets Manager is a managed service that helps applications securely store and retrieve sensitive information. A secret can contain database credentials, API keys, OAuth tokens, or other confidential information.
For example, instead of writing a database password directly in a Node.js application:
DB_PASSWORD = "MyPassword123"
the password can be stored in Secrets Manager. The application then retrieves the secret at runtime.
A secret can contain multiple key-value pairs, commonly represented using JSON. For example:
{
"username": "admin",
"password": "example-password",
"host": "database.example.com",
"port": "3306"
}
Secrets Manager stores the secret in encrypted form and controls access using AWS Identity and Access Management (IAM).

Why is Secrets Manager Needed?
Hard-coded credentials create a major security risk. If an application repository becomes public or is accessed by an unauthorized person, the credentials may also be exposed.
Secrets Manager solves this problem by separating application code from sensitive credentials.
Instead of:
Application
↓
Password stored in code
↓
Database
we can use:

The application retrieves the required secret when it needs it instead of keeping the sensitive value permanently inside its source code.

Key Features of AWS Secrets Manager
1. Secure Secret Storage
Secrets Manager stores sensitive information securely and encrypts secrets at rest using AWS Key Management Service (AWS KMS). Secrets are also protected while being transmitted. AWS provides an AWS-managed KMS key for the standard encryption option, while organizations can also use their own customer-managed KMS keys when required.
2. Automatic Secret Rotation
One of the most useful features of Secrets Manager is automatic rotation. Rotation means periodically changing a credential so that an old password or key does not remain valid indefinitely.
For supported AWS services, managed rotation can be configured. Other types of secrets can use an AWS Lambda function to perform rotation. Rotation schedules can be configured using rate or cron expressions.
For example:
Old Password
↓
Secrets Manager
↓
Automatic Rotation
↓
New Password

This reduces the risk associated with long-term credentials.
3. Access Control Using IAM
Secrets should not be accessible to every user or application. Secrets Manager integrates with AWS IAM, allowing administrators to control which users and services can retrieve or modify particular secrets.
For example, an application may be given permission to read one database secret but not other secrets belonging to different applications.
4. Secret Versioning
Secrets Manager maintains different versions of secret values. Versions can be identified using labels such as AWSCURRENT, AWSPREVIOUS, and AWSPENDING. This is useful during secret updates and rotation.

Practical Example
Consider a college student management application developed using React and Node.js. The backend needs a database username and password to access the student database.
A beginner might store the credentials directly in the application:
username = "admin"
password = "college123"
This is not a good security practice.
Instead, the developer can create a secret in AWS Secrets Manager:
Secret Name:
college-app/database

Secret Value:
username = admin
password = college123
The backend application is given appropriate IAM permission to retrieve this secret.
The process becomes:

The password is therefore not required to be written directly into the application's source code.
AWS also provides tutorials for moving hard-coded application secrets and database credentials into Secrets Manager.

Real-World Applications
AWS Secrets Manager can be useful in many real-world situations.
1. E-commerce applications:
Online shopping applications may need database credentials, payment API keys, and third-party service credentials.
2. Banking and financial applications:
Financial systems handle highly sensitive information and require strong access control for application credentials.
3. Healthcare applications:
Healthcare applications can use secret management to protect database credentials and API authentication information.
4. Cloud-based applications:
Applications running on AWS services such as Amazon EC2, AWS Lambda, and Amazon ECS can retrieve secrets when they need to communicate with databases or other services.
Thus, Secrets Manager is useful anywhere an application needs to securely manage credentials without embedding them directly into its code.

Advantages
AWS Secrets Manager provides several advantages:
• Improved security: Sensitive credentials do not need to be hard-coded into application source code.
• Automatic rotation: Credentials can be periodically changed to reduce the risk of compromised long-term credentials.
• Centralized management: Application secrets can be managed from a centralized AWS service.
• IAM integration: Access can be restricted to authorized users and applications.
• Encryption: Secret values are protected using AWS KMS-based encryption.
• Application integration: Applications can retrieve secrets using AWS SDKs and APIs.

Limitations
Although Secrets Manager provides strong security features, there are some considerations.
First, it is a paid AWS service, so applications using many secrets or making extensive use of the service need to consider cost.
Second, developers must configure IAM permissions correctly. Giving excessive permissions can create security risks.
Third, automatic rotation can require additional configuration. For some non-database secrets, rotation uses AWS Lambda, which adds another component to the architecture.
Finally, Secrets Manager should not be treated as a replacement for every type of sensitive data. AWS recommends different services for specific purposes, such as IAM for AWS credentials and AWS KMS for encryption keys.
Conclusion
AWS Secrets Manager provides a secure and convenient way to manage sensitive information used by modern applications. Instead of placing passwords, API keys, and other credentials directly inside source code, developers can store them securely and allow authorized applications to retrieve them when required.
Its important features include secure storage, encryption, IAM-based access control, automatic rotation, and secret versioning. These capabilities make Secrets Manager useful for applications ranging from student projects to large enterprise systems.
For developers, one of the most important lessons is simple: credentials should not be treated like ordinary application data. Keeping secrets outside source code is an important step toward building safer cloud applications.

AWS Documentation References

Cloud workshop

SANDHIYA N — Tue, 15 Sep 2026 06:53:53 +0000

During the AWS workshop, I gained an introduction to cloud computing and Amazon Web Services (AWS). The major concepts covered were:
SESSION - 1:
AWS Pay-As-You-Go: Learned how AWS follows a usage-based pricing model, where users pay for the cloud resources they consume.
Cloud Service Models: Learned the basic concepts of IaaS, CaaS, PaaS, FaaS, SaaS, and AIaaS and their different levels of service and management.
AWS Cloud Quest: Explored AWS services through interactive, scenario-based cloud learning.
AWS Regions: Understood that AWS services and features can vary across Regions, and that selecting an appropriate Region is important for service availability, pricing, and resource deployment.
Billing: Learned the basics of AWS billing and the importance of monitoring resource usage.
Hands-on Activity: Portfolio Deployment Using Amazon S3 and CloudFront

Amazon S3

Amazon Simple Storage Service (S3) is an object storage service used to store and retrieve files in the cloud. In the workshop, S3 was used to host a static portfolio website.

Steps Performed

Step 1: Create an S3 Bucket

An S3 bucket was created through the AWS Management Console. The bucket provides the storage location for the portfolio files.

Step 2: Create the Portfolio

A static portfolio webpage was created using HTML. The main webpage was saved as:

index.html

This file contained the portfolio information and served as the entry point of the website.

Step 3: Upload the Website Files

The index.html file and other required portfolio files were uploaded into the S3 bucket as objects.

Step 4: Enable Static Website Hosting

Static website hosting was enabled for the bucket, and index.html was specified as the Index document.

Step 5: Test the Website

The S3 website endpoint was used to access and verify the portfolio in a web browser.

Thus, the portfolio was successfully hosted using Amazon S3.

Amazon CloudFront

Amazon CloudFront is an AWS Content Delivery Network (CDN) that distributes website content through a network of edge locations.

After hosting the portfolio in S3, CloudFront was used to create a distribution for the portfolio.

Steps Performed

Step 1: Open CloudFront

Amazon CloudFront was opened from the AWS Management Console.

Step 2: Create a Distribution

A new CloudFront distribution was created and the S3-hosted portfolio was configured as the origin.

Step 3: Configure the Distribution

The required CloudFront settings were configured, including the default/root object for the website.

Step 4: Deploy the Distribution

The CloudFront distribution was created and allowed to complete its deployment.

Step 5: Access the Portfolio

CloudFront provided a distribution domain name. This domain was used to access the deployed portfolio.

Deployment Flow
User
↓
CloudFront
↓
Amazon S3
↓
index.html
↓
Portfolio Website
Result

The static portfolio was successfully stored and hosted using Amazon S3 and distributed through Amazon CloudFront. This hands-on activity provided practical experience in AWS-based website hosting and content delivery.

SESSION - 2:
In the second session of my AWS workshop, I got hands-on experience with three important AWS services: Amazon CloudFront, AWS Lambda, and Amazon CloudWatch.

🚀 Amazon CloudFront

I worked with CloudFront, AWS's Content Delivery Network (CDN), to distribute my portfolio website. I learned how CloudFront works with an S3 bucket as an origin and delivers website content through AWS edge locations.

Flow:

User → CloudFront → S3 → Portfolio

This helped me understand how cloud-based websites can be delivered efficiently to users.

⚡ AWS Lambda

I also worked with AWS Lambda and explored serverless computing. Instead of managing a server, Lambda allows code to run automatically in response to events.

As a practical exercise, I created a Lambda function that could receive and process S3 events, such as when a file is uploaded or deleted from an S3 bucket.

Example flow:

S3 Event → Lambda → Process Event

This gave me a basic understanding of event-driven and serverless architecture.

📊 Amazon CloudWatch

I also explored Amazon CloudWatch for monitoring AWS resources and applications. I learned how CloudWatch can collect logs and provide information about what is happening inside AWS services.

For Lambda, CloudWatch helped me view execution logs and function output, making it useful for monitoring and debugging serverless applications.

💡 Key Takeaways

Through this session, I gained practical exposure to:

🌐 CloudFront – Content delivery and CDN
⚡ Lambda – Serverless and event-driven computing
📊 CloudWatch – Monitoring and logging
🔗 Connecting AWS services together
☁️ Understanding basic serverless cloud architecture

This session helped me move from simply learning AWS concepts to understanding how different AWS services can work together to build and monitor cloud-based applications.