Cloud secret managers | DevOps Peach

AWS Secrets Manager, AWS SSM Parameter Store and Azure Key Vault store secrets encrypted with KMS, control access with IAM or RBAC, rotate automatically and audit reads; apps read them with a managed identity instead of keys.

When to use a cloud secret manager

If your infrastructure lives mostly on one cloud, the built-in service is usually simpler than running Vault yourself: no unsealing, HA or backups to manage, and it integrates with IAM, logging and other services.

Service	Key points
AWS Secrets Manager	Stores secrets, rotates them with Lambda (built in for RDS), priced per secret
AWS SSM Parameter Store	`SecureString` encrypted with KMS, cheaper, good for config and simple secrets
Azure Key Vault	Secrets, keys and certificates; access via Azure RBAC; soft-delete and purge protection
Google Secret Manager	Similar, with IAM access control

AWS

aws secretsmanager create-secret --name prod/myapp/db \
  --secret-string '{"username":"app","password":"changeme-example"}'
aws secretsmanager get-secret-value --secret-id prod/myapp/db \
  --query SecretString --output text
aws ssm get-parameter --name /myapp/prod/api-key --with-decryption

Read access is granted by an IAM policy with the secretsmanager:GetSecretValue action on the secret's exact ARN, attached to the IAM role of the EC2 instance, ECS task or Lambda. Every read is recorded in CloudTrail.

Azure

az keyvault secret set --vault-name kv-example --name db-password --value changeme-example
az keyvault secret show --vault-name kv-example --name db-password --query value -o tsv

App Service, VMs and AKS use a managed identity assigned the Key Vault Secrets User role. App Service also supports Key Vault references: a setting such as @Microsoft.KeyVault(SecretUri=...) is replaced with the real value automatically.

flowchart LR
  APP["App on VM / container"] -- "managed identity / IAM role" --> ID["Entra ID / STS"]
  ID -- "short-lived token" --> APP
  APP -- "read secret" --> KV["Key Vault / Secrets Manager"]
  KV -. "audit" .-> LOG["CloudTrail / Activity log"]

Good practice

Use structured names by environment and app (prod/myapp/db) and grant access on the narrowest prefix.
Turn on automatic rotation for database credentials.
Apps should cache secrets briefly instead of calling the API on every request, to cut cost and latency.
Enable soft-delete and purge protection on Key Vault so a mistaken delete does not lose secrets.
Avoid printing values on a shared terminal; in scripts, assign them straight to a variable or a tightly permissioned file.