AWS Secrets Manager vs Parameter Store
Fast recall
Quick revision
Core answer
Configuration management security practices in cloud environments
Storing secrets in environment variables in the task definition in plaintext, or in application.properties committed to Git
Describe how Spring Boot can load both Secrets Manager and Parameter Store values at startup using Spring Cloud AWS, with automatic refresh
Interview-ready guide
Interview answer
AWS Secrets Manager and Systems Manager Parameter Store both securely store configuration, but they serve different purposes — Secrets Manager is for credentials that must rotate; Parameter Store is for configuration that changes infrequently.
Secrets Manager — for credentials with rotation
- Secrets Manager stores secrets (database passwords, API keys, OAuth tokens) and can automatically rotate them on a schedule — which means your RDS password rotates every 30 days and the Lambda or ECS task that reads it at runtime gets the current version, without a deployment
- Automatic rotation uses a Lambda function that updates both Secrets Manager and the underlying resource (e.g., the RDS password) atomically; if the update fails, the old secret remains valid
Parameter Store — for configuration and non-secret values
- Parameter Store stores both plain-text and encrypted (SecureString) parameters; it's free for standard parameters and supports hierarchical paths —
/myapp/prod/database-url,/myapp/prod/feature-flag-enabled - SecureString parameters use KMS for encryption and cost the same as Secrets Manager at much lower usage, but without automatic rotation
- Use Parameter Store for: feature flags, environment-specific config, non-rotating encrypted values, and anything you'd otherwise put in a properties file
Integration with Spring Boot
- Spring Cloud AWS provides
spring-cloud-aws-starter-secretsmanagerandspring-cloud-aws-starter-parameter-store— both integrate as SpringPropertySourceimplementations, which means you reference secrets with@Value("${my-secret-key}")and Spring resolves them at startup from AWS - Cache the resolved values to avoid fetching from AWS on every property access; configure
spring.cloud.aws.secretsmanager.reload.strategyfor runtime rotation pickup without restarts
AWS Secrets Manager vs Parameter Store
Direct Answer
Secrets Manager is purpose-built for secrets (database passwords, API keys) with automatic rotation and higher cost. Parameter Store is a general-purpose hierarchical configuration store — free for standard parameters, lower cost for advanced. Use Secrets Manager for credentials requiring rotation; use Parameter Store for non-secret configuration and lower-volume secret storage.
Common Mistakes & Pitfalls
Storing secrets in environment variables in the task definition in plaintext, or in application.properties committed to Git
Check your understanding
Answer these without looking back at the article.
- How do you load AWS Secrets Manager values into Spring Boot application properties at startup?
- How does Secrets Manager automatic rotation work for an RDS database password?
- What happens if Secrets Manager is unavailable when your Spring Boot app starts?
Related interview prep categories
1Looking for a structured roadmap?
Every module on this page is also part of the full Java backend interview track.