AWS Secrets Management Solution
Terraform module that splits secrets between Secrets Manager and Parameter Store by whether they need rotation, with Lambda-driven rotation and CloudTrail-based alerting on top.
Putting every secret into Secrets Manager is easy and expensive at $0.40 per secret per month, and putting everything into Parameter Store gives up automated rotation. The question is which secret belongs where, and how to keep that split honest as the inventory grows.
I built a Terraform module that routes each secret by shape: rotating credentials into Secrets Manager, static config values into Parameter Store standard parameters at zero cost, all under a customer-managed KMS key with rotation on. A Lambda handles PostgreSQL and MySQL rotation on a per-secret schedule, EventBridge rules watch CloudTrail for GetSecretValue and AccessDenied events, and an in-memory cache in the retrieval Lambda cuts API calls during hot paths.
The cheapest secret is the one that lives in the right service, not the fanciest one.
Secrets rotate on their own schedule, rotation failures land in an SNS alert instead of a silent CloudWatch metric, and the cost profile scales with the number of things that need rotating.
- Secrets Manager vs Parameter Store split by whether rotation is needed
- Lambda rotation for PostgreSQL and MySQL on per-secret schedules
- EventBridge on CloudTrail catches AccessDenied on secret reads in near real time