JobCannon
全部技能

AWS Secrets Manager

⬢ 層級 2技術
高
薪資影響
2 個月
學習時長
中等
難度
—
職業
一覽

AWS Secrets Manager is the managed secrets service for high-rotation, high-risk credentials: database passwords, API keys, OAuth tokens, SSH keys. Key differentiation vs Parameter Store: automatic rotation (database password changes every 30 days), multi-region replication, immediate secret revocation on breach. Integrates with AWS Lambda for custom rotation logic. Use Secrets Manager for secrets that rotate frequently (databases, API tokens), Parameter Store for static config. Why it matters: automatic rotation reduces exposure window, meets compliance (HIPAA, SOC2, PCI-DSS), prevents credential sprawl. Salary impact: teams using proper secret rotation ($300/month Secrets Manager) avoid breaches costing millions. Learning path: 3 days basics (create/rotate secrets), 1 week intermediate (Lambda rotation, replication), 1 month production (audit, compliance, cost optimization).

什麼是 AWS Secrets Manager

AWS Secrets Manager is a managed service for storing, rotating, and managing secrets, database passwords, API keys, OAuth tokens, SSH keys. Unlike Secrets Parameter Store (which is static), Secrets Manager is designed for high-rotation, high-risk credentials that change frequently. Core capability: automatic rotation. Schedule a Lambda function to run every 30 days (or on demand), generate a new password, update the target database/service, and store the new secret in Secrets Manager. Applications always read the current version. Old versions kept for rollback.

🔧 工具與生態
AWS Secrets ManagerAWS LambdaAWS RDSboto3AWS CLIAWS KMSCloudTrailEventBridge

📋 開始之前

Cloud SecurityAws Lambda

💰 各地區薪資

地區初級中級高級
USA$85,000$130,000$190,000
UK£50,000£80,000£125,000
EU€55,000€85,000€135,000
CANADACA$90,000CA$125,000CA$180,000

❓ 常見問題

Should I use Secrets Manager or Parameter Store?
Secrets Manager: high-rotation secrets (DB password, API keys that change weekly). Parameter Store: config, feature flags, static API keys. Hybrid: use both. Secrets Manager costs $0.40/secret/month; Parameter Store is free. For 10 secrets, Secrets Manager = $5/month (worth it for rotation automation).
How does automatic rotation work?
Secrets Manager invokes a Lambda function on schedule (every 30 days by default). Lambda: reads old secret, generates new password, updates database/service, stores new secret in Secrets Manager. On success, Secrets Manager marks secret as rotated; old versions kept for rollback.
Can I replicate secrets across regions?
Yes. Secrets Manager auto-replicates to secondary regions (read-only by default). On primary region failure, promote secondary. Enables disaster recovery for secrets. Replication cost: $0.40/secret/month per region.
What happens when a secret is breached?
Use RotateSecretImmediate to rotate immediately (don't wait 30 days). Lambda runs rotation logic, generates new password, updates target. Old versions kept in history for debugging. Combined with EventBridge alerts, enables instant response.
How do I prevent an application from reading an old secret after rotation?
Secrets Manager returns the current version by default. Store version ID in application config only if needed for specific versions. Application should always GetSecretValue (current version). Old versions archived in history.
Can Secrets Manager rotate non-AWS services (third-party APIs)?
Yes, via custom Lambda rotation functions. For AWS RDS/Redshift/DocumentDB, use built-in rotation templates. For third-party (Stripe, Twilio, Salesforce), write a Lambda that rotates via their API. More setup, but fully supported.
Is there a free tier for Secrets Manager?
No. Charges: $0.40/secret/month + $0.06 per 10k API calls (first 100k free per month). Parameter Store is cheaper for most teams. Secrets Manager justified only if you have 5+ secrets needing rotation.

不確定這項技能適不適合你？

做一下職業匹配，我們會推薦合適的方向。

找到最適合我的技能 →

找到理想的職業方向

在 2,521 個職業中進行技能匹配。免費。

免費做職業匹配 →