Parameter Store vs Secrets Manager

AWS Systems Manager Parameter Store and AWS Secrets Manager both store configuration data and secrets in AWS. Parameter Store is a free, general-purpose configuration store. Secrets Manager is a purpose-built, paid secrets management service with automatic rotation.

Core Differences

Parameter Store — Configuration First

Parameter Store is part of AWS Systems Manager. It stores three types of parameters: String (plain text), StringList (comma-separated values), and SecureString (KMS-encrypted). The path-based hierarchy (/myapp/prod/db/host) enables organized configuration management.

The free tier supports up to 10,000 standard parameters at 40 TPS. For many applications, this covers both configuration and secrets at zero cost.

Secrets Manager — Secrets First

Secrets Manager is purpose-built for sensitive data. Every secret is encrypted by default. The rotation framework automatically rotates credentials for supported AWS databases. Staging labels manage the rotation lifecycle — AWSPENDING for the new credential, AWSCURRENT for the active one, AWSPREVIOUS for rollback.

The Cost Question

Parameter Store's free tier is its biggest advantage. 10,000 parameters at zero cost covers most applications. Secrets Manager charges $0.40/secret/month — at 100 secrets, that is $40/month for storage alone.

Many teams use Parameter Store for non-sensitive configuration and Secrets Manager only for credentials that need rotation. This hybrid approach minimizes cost.

Rotation

Secrets Manager's automatic rotation is the primary reason to pay for it. Configure rotation for an RDS database password, and Secrets Manager handles everything: generate new password, update the database, update the secret, and clean up. This security automation is valuable for compliance.

Parameter Store has no rotation. You must build custom Lambda functions and EventBridge rules to achieve similar functionality.

System Design Interviews

In system design interviews, distinguishing between configuration and secrets management shows AWS depth. Use Parameter Store for config, Secrets Manager for credentials that rotate. See also: security patterns and AWS architecture.