AWS Solutions Architect Associate · Trade-off

Secrets Manager vs Parameter Store: Credentials or Configuration

Use AWS Secrets Manager for credentials that must rotate automatically, such as database passwords and API keys. Use AWS Systems Manager Parameter Store for configuration values such as AMI IDs, URLs and feature flags, where standard parameters cost nothing extra. Both encrypt with AWS KMS and are read at runtime, so neither value belongs in code, AMIs or user data.

Last updated October 2026.

What they have in common

Both let code fetch a value at runtime with its IAM role's credentials instead of carrying it, so changing the value needs no redeploy. Both encrypt with AWS KMS, control reads with IAM, and log every call in AWS CloudTrail. AWS Lambda, Amazon ECS task definitions and AWS CloudFormation can reference either.

On the exam, any option that keeps a secret in source code, an AMI, EC2 user data or a plain environment file is wrong, whichever store the other options use.

Secrets Manager: built for credentials

Automatic rotation on a schedule, which changes the credential in the secret and in the database together. Managed rotation covers many AWS-managed secrets; others rotate with a Lambda function.
Cross-account sharing through a resource policy on the secret. The catch: the default AWS managed key cannot be used across accounts, so encrypt with a customer managed KMS key whose key policy allows the other account.
Replication of secrets to other Regions.
Priced per secret per month plus API calls. AWS's pricing examples use $0.40 per secret per month.

Parameter Store: configuration, free to start

	Standard	Advanced
Per account and Region	10,000 parameters	100,000 parameters
Value size	4 KB	8 KB
Policies and sharing	Neither	Parameter policies; shareable with other accounts
Cost	No additional charge	Per parameter per month, plus API calls

Tiers and pricing from the AWS Systems Manager documentation and pricing page; Secrets Manager pricing from its pricing page, checked 23 October 2026.

Values are String, StringList or SecureString (encrypted with KMS), organized in paths such as /prod/app/ that IAM policies can scope. There is no built-in rotation, and AWS's own guidance points to Secrets Manager for credentials.

Side by side

	Secrets Manager	Parameter Store
Built for	Credentials, API keys, tokens	Configuration values
Rotation	Automatic, scheduled	None
Cross-account	Resource policy plus customer managed key	Advanced tier only
Cost	Per secret per month	Standard tier free

Signals that decide the question

Secrets Manager

"Rotate automatically", "database credentials", "RDS password every 30 days", "share a secret across accounts", "replicate to another Region".

Parameter Store

"Configuration values", "AMI ID", "feature flags", "hierarchy per environment", "lowest cost", and nothing that needs rotation.

The tempting wrong answer: a Parameter Store SecureString for a password that must rotate every 30 days. It is encrypted, but nothing rotates it, so someone has to change the database and the parameter by hand.

FAQ

What is the difference between Secrets Manager and Parameter Store?

Secrets Manager is built for credentials and can rotate them automatically, replicate them across Regions and share them across accounts, priced per secret. Parameter Store holds configuration values in a hierarchy, with a free standard tier and no built-in rotation.

Can Parameter Store rotate secrets?

No. Parameter Store has no built-in rotation. For credentials that must change on a schedule, use Secrets Manager, which rotates the value in the secret and the database together.

Is Parameter Store free?

Standard parameters are free: up to 10,000 per account and Region, 4 KB each. Advanced parameters, which hold 8 KB and can be shared across accounts, are charged per parameter per month.

How do you share a Secrets Manager secret with another AWS account?

Attach a resource policy to the secret that names the other account's role, and encrypt the secret with a customer managed KMS key whose key policy allows that account. The default AWS managed key cannot be used across accounts.

Practise the choice

Chapter 13 of the Certified SAA-C03 course animates rotation and walks through cross-account sharing, with a question for each direction. Unit 1 is free.

Open Chapter 13 →