Managing Secrets, Credentials & Certificates in AWS: Parameter Store, Secrets Manager, ACM & CloudHSM
“Encryption protects your data. Secrets protect your applications. Certificates protect your communication.”
In the previous articles, aws kms and key policies, We explored how AWS Key Management Service (AWS KMS) secures encryption keys and enables cryptographic operations across AWS services. However, encryption keys are only one piece of a secure cloud architecture.
Modern applications rely on many other sensitive assets, including:
- Database credentials
- API keys
- OAuth tokens
- JWT signing keys
- SSH private keys
- TLS certificates
- Environment variables
Storing these values insecurely can expose an entire application, even if the underlying data is encrypted.
For example, consider the following application configuration:
spring.datasource.url=jdbc:mysql://prod-db.amazonaws.com
spring.datasource.username=admin
spring.datasource.password=MyPassword123Anyone with access to this configuration file now has direct access to the production database.
This is why AWS provides dedicated services for securely managing secrets and certificates.
In this article, we’ll explore:
- AWS Systems Manager Parameter Store
- AWS Secrets Manager
- AWS Certificate Manager (ACM)
- AWS CloudHSM
We’ll also learn when to use each service, compare their capabilities, and examine real-world architectural patterns.
What is Parameter Store?
Parameter Store is a secure, hierarchical storage service for configuration data and application parameters.
Parameters can be organized logically using hierarchical paths.
Example:
/prod/database/host
/prod/database/port
/prod/database/name
/dev/database/host
/dev/database/portThis makes managing multiple environments much easier.
Parameter Policies
Advanced parameters support policies such as:
- Expiration
- Expiration notifications
- No-change notifications
For example, a temporary configuration parameter can automatically expire after 30 days, reducing the risk of outdated settings lingering in production.
There are two tiers : Standard (free and doesn’t include policies) and Advanced tier (charged and includes parameter policies with higher no of parameters and parameter size)
What is AWS Secrets Manager?
AWS Secrets Manager securely stores and manages secrets such as:
- Database passwords
- API keys
- OAuth tokens
- SSH private keys
- JWT signing keys
- Third-party credentials
All secrets are encrypted using AWS KMS before being stored.
Get Satyavarssheni’s stories in your inbox
Join Medium for free to get updates from this writer.
Multi-Region Secrets — For globally distributed applications, Secrets Manager supports secret replication across Regions. This improves availability and reduces latency.
When Should You Use Each?
Use Parameter Store for:
- Configuration values
- Environment variables
- Feature flags
- Application settings
Use Secrets Manager for:
- Database passwords
- API keys
- OAuth tokens
- Authentication secrets
- Credentials requiring automatic rotation
AWS Certificate Manager (ACM)
Applications also need to secure communication. Whenever users access an HTTPS website, a TLS certificate establishes an encrypted connection between the client and the server. Managing certificates manually can be time-consuming.
AWS Certificate Manager (ACM) simplifies this process.
AWS Certificate Manager is a fully managed service that provisions, deploys, manages, and renews TLS/SSL certificates for AWS resources.
Automatic Certificate Renewal — Public ACM certificates are automatically renewed approximately 60 days before expiration, provided DNS validation remains in place and the certificate is still in use. This eliminates one of the most common causes of website outages: expired certificates.
Imported Certificates — Organizations can also import certificates issued by external Certificate Authorities. However, ACM does not automatically renew imported certificates.
AWS CloudHSM
AWS KMS works well for the vast majority of workloads. However, some organizations require complete control over the Hardware Security Module itself. For these use cases, AWS offers CloudHSM.
AWS CloudHSM provides dedicated Hardware Security Modules (HSMs) that are provisioned exclusively for your organization.
Unlike KMS, the HSM is not shared with other AWS customers. You manage the HSM cluster yourself.
Characteristics
- Dedicated hardware
- Supports symmetric and asymmetric keys
- Customer controls key lifecycle
- Supports standard cryptographic APIs
- Uses CloudHSM client software
- Highly available across multiple Availability Zones
CloudHSM is commonly used when regulatory or organizational requirements mandate exclusive control over cryptographic hardware.
Best Practices
- Never hard-code secrets in source code or configuration files.
- Store application configuration in Parameter Store.
- Store credentials and API keys in Secrets Manager.
- Enable automatic secret rotation whenever supported.
- Prefer DNS validation for ACM certificates.
- Monitor certificate expiration using EventBridge or AWS Config.
- Use CloudHSM only when dedicated HSM control is a compliance requirement; otherwise, AWS KMS is the simpler and more integrated choice.
Key Takeaways
A secure cloud architecture is built on more than encryption. Applications also need secure ways to manage configuration values, protect credentials, and establish trusted communication.
- Parameter Store centralizes application configuration and environment parameters.
- Secrets Manager securely stores and automatically rotates sensitive credentials.
- AWS Certificate Manager simplifies TLS certificate provisioning and renewal.
- CloudHSM provides dedicated hardware security modules for organizations requiring exclusive control over cryptographic operations.
Together with AWS KMS, these services form the foundation of a secure, scalable, and production-ready AWS security architecture.
