AWS Secrets Manager vs Parameter Store

AWS has two places to keep a secret, and teams often end up using both without a rule for which goes where. Secrets Manager is built around credentials that rotate and charges per secret, while Systems Manager Parameter Store is a free hierarchical key-value store that can encrypt values with KMS, and the overlap starts to cost money or reliability once a service scales out and every task reads its config at boot.

This comparison covers how the two differ on rotation, pricing, limits and throughput, then how Encore handles application secrets so the choice stops being made one secret at a time.

Secrets Manager vs Parameter Store at a glance

How does Encore handle secrets?

Encore combines an open source infrastructure SDK with a platform that provisions and deploys into your own AWS or GCP account. A secret is a field on a package-level struct in the service that uses it, the value is set per environment type from the CLI or dashboard, and on AWS Encore stores it in AWS Secrets Manager and injects it into the service at runtime with access scoped to that service.

Set up the app

The service reads the value from the struct, with no SDK call and no ARN in the code:

// billing/billing.go
package billing

import (
	"context"

	"github.com/stripe/stripe-go/v87"
)

// Values are set per environment with `encore secret set`.
var secrets struct {
	StripeKey string
}

type CreateCustomerParams struct {
	Email string `json:"email"`
}

type CreateCustomerResponse struct {
	ID string `json:"id"`
}

//encore:api private method=POST path=/customers
func CreateCustomer(ctx context.Context, p *CreateCustomerParams) (*CreateCustomerResponse, error) {
	sc := stripe.NewClient(secrets.StripeKey)
	c, err := sc.V1Customers.Create(ctx, &stripe.CustomerCreateParams{
		Email: stripe.String(p.Email),
	})
	if err != nil {
		return nil, err
	}
	return &CreateCustomerResponse{ID: c.ID}, nil
}

--type takes production, development, preview and local (or prod, dev, pr), so one command covers every production environment and another covers the rest, as described in the secrets docs. encore run fetches the local values onto the developer's machine, and a personal override can live in .secrets.user.toml, which encore secret set adds to .gitignore. Values are stored on Encore and in your cloud's secret store, never in the repository, so an AI coding agent working in the codebase sees the StripeKey field and can use it but has no way to read or leak the value.

Database credentials never become secrets you manage at all, because Encore creates a database role per service and injects the connection at runtime, which removes the most common reason teams reach for Secrets Manager rotation. Secrets injected at startup also mean no GetParameter calls at boot, so a deploy that starts fifty tasks does not run into Parameter Store throttling.

Secret values are set per environment type with encore secret set, which the CLI reference lists, and preview environments read the preview values so a pull request never sees production keys. Values can also come from an existing vault, as the external vaults docs describe.

Best fit: Teams who want API keys and tokens declared next to the code that uses them and stored in Secrets Manager in their own AWS account with per-service access set up for them.

AWS Secrets Manager

Secrets Manager

Secrets Manager stores secrets up to 64 KB, encrypts them with KMS, versions them with staging labels (AWSCURRENT, AWSPREVIOUS) and can rotate them on a schedule. For RDS, Aurora and Redshift it offers managed rotation, and RDS can own the master password outright with manage_master_user_password. It also supports cross-account resource policies and replication of a secret to other Regions, which matters for multi-Region failover.

The cost is $0.40 per secret per month and $0.05 per 10,000 API calls, according to the pricing page, which is small for ten secrets and noticeable for a few thousand spread across environments. Custom rotation for a third-party API key means writing and maintaining a Lambda function that implements the four rotation steps, so in practice most non-database secrets are never rotated automatically.

Best fit: Database credentials that should rotate, and secrets that must be shared across accounts or replicated across Regions.

AWS Systems Manager Parameter Store

Parameter Store

Parameter Store holds String, StringList and SecureString parameters in a path hierarchy such as /myapp/prod/log-level, and SecureString values are encrypted with KMS. Standard parameters allow up to 10,000 per account and Region with a 4 KB value limit at no extra charge, and advanced parameters raise that to 100,000 and 8 KB, add policies such as expiration, and cost money, per the parameter tiers docs. There is no built-in rotation.

The limit that catches teams is throughput: by default GetParameter, GetParameters and GetParametersByPath share 40 transactions per second per account and Region, and AWS's throughput docs name the exact scenario of an ECS deployment starting many tasks that each read settings at boot. Higher throughput raises the ceiling to 10,000 TPS for GetParameter at $0.05 per 10,000 API interactions.

Best fit: Non-secret configuration and secrets that rarely change, read once at startup by a modest number of tasks.

Using them together on ECS

ECS task definitions accept both in the same secrets block, with valueFrom pointing at a Secrets Manager ARN or a parameter ARN, and the task execution role needs secretsmanager:GetSecretValue or ssm:GetParameters on each one. For a SecureString encrypted with a customer-managed KMS key, the role also needs kms:Decrypt on that key, and the key policy must permit the role. Parameter Store can also return a Secrets Manager secret through the /aws/reference/secretsmanager/ path, which lets code read everything through one API. Each new secret means an entry in the task definition and a line in the IAM policy, so the wiring grows with the number of services.

How to choose

Pick Encore when application secrets should be declared in the code that uses them and stored in Secrets Manager in your own AWS account, with per-service access and no runtime lookups to throttle. Pick Secrets Manager directly for credentials that rotate or cross account boundaries. Pick Parameter Store for configuration and stable secrets when cost matters more than rotation and the read rate stays well under 40 per second.

Related guides

• What is AWS Secrets Manager?
• How to use AWS Secrets Manager with ECS
• Best secrets management tools
• How to add secrets to a Go API
• What is AWS IAM?