AWS for DevOps — Configuration & Secrets Management

1 minute read

Chapter 11 — Configuration & Secrets Management

Managing configuration and secrets is one of the most important DevOps responsibilities. Hard-coded credentials in code are a security incident waiting to happen. AWS provides purpose-built services to store, manage, and rotate configuration and secrets.

What You Will Learn

Section Topic Key Concept
11.1 SSM Parameter Store Centralized configuration storage
11.2 Secrets Manager Encrypted secrets with automatic rotation
11.3 SSM Session Manager Secure shell access without SSH
11.4 AWS Config Configuration compliance and auditing
11.5 SSM Run Command Remote command execution at scale
11.6 Practice Exercises Hands-on labs

The Configuration Hierarchy

  ┌──────────────────────────────────────────────────────┐
  │              Configuration Sources                    │
  │                                                       │
  │  ┌────────────┐  ┌──────────────┐  ┌──────────────┐ │
  │  │ Environment │  │  Parameter   │  │   Secrets    │ │
  │  │  Variables  │  │    Store     │  │   Manager    │ │
  │  │             │  │              │  │              │ │
  │  │ DB_HOST=... │  │ /app/db/host │  │ db-password  │ │
  │  │ APP_ENV=... │  │ /app/env     │  │ api-key      │ │
  │  └──────┬──────┘  └──────┬───────┘  └──────┬───────┘ │
  │         │                │                  │         │
  │         └────────────────┼──────────────────┘         │
  │                          ▼                            │
  │                  ┌──────────────┐                     │
  │                  │ Application  │                     │
  │                  └──────────────┘                     │
  └──────────────────────────────────────────────────────┘

Parameter Store vs Secrets Manager

Feature Parameter Store Secrets Manager
Cost Free (Standard tier) $0.40/secret/month
Max size 8 KB (Standard) / 8 KB (Advanced) 64 KB
Encryption Optional (KMS) Always encrypted (KMS)
Auto rotation No Yes (Lambda-based)
Cross-account No (use resource policies) Yes (resource policies)
Best for Config values, feature flags Database passwords, API keys

When to Use What

Scenario Service Why
Database connection strings Secrets Manager Auto-rotation, always encrypted
API keys for third-party services Secrets Manager Sensitive, needs encryption
Feature flags Parameter Store Free, simple key-value
Application configuration Parameter Store Hierarchical, free tier
Environment-specific settings Parameter Store Path-based: /prod/app/db_host
Compliance auditing AWS Config Track resource configuration changes
Patch management SSM Run Command Execute commands across fleet

Next → SSM Parameter Store

Updated:

You may also enjoy