AWS Secrets Manager encrypts secrets at rest using encryption keys that you own and store in AWS Key Management Service (AWS KMS). 

• When you retrieve a secret, Secrets Manager decrypts the secret and transmits it securely over TLS to your local environment.
• Secrets Manager integrates with AWS Identity and Access Management (IAM) to control access to the secret using fine-grained IAM policies and resource-based policies.

With AWS Secrets Manager, you can rotate secrets on a schedule or on demand by using the Secrets Manager console, AWS SDK, or AWS CLI. 

• Secrets Manager natively supports rotating credentials for databases hosted on Amazon RDS and Amazon DocumentDB and clusters hosted on Amazon Redshift.
• You can extend Secrets Manager to rotate secrets used with other AWS or 3P services by modifying sample Lambda functions.

Build your applications with security of secrets top of mind.

• Secrets Manager provides code samples to call Secrets Manager APIs from common programming languages. There are two types of APIs to retrieve secrets:
  • Retrieve a single secret by name or ARN.
  • Retrieve a group of secrets by providing a list of names or ARNs, or filter criteria such as tags.
• Configure Amazon Virtual Private Cloud (VPC) endpoints to keep traffic between your VPC and Secrets Manager within the AWS network.
• You can also use Secrets Manager client-side caching libraries to improve availability and reduce latency during secrets retrieval.

You can use AWS Secrets Manager to meet compliance requirements.

• Use AWS Config Rules to help you verify that your secrets are configured in accordance with your organization’s security and compliance requirements.
• Manage secrets for workloads that are subject to Department of Defense Cloud Computing Security Requirements Guide (DoD CC SRG IL2, DoD CC SRG IL4, and DoD CC SRG IL5), Federal Risk and Authorization Management Program (FedRAMP), U.S. Health Insurance Portability and Accountability Act (HIPAA), Information Security Registered Assessors Program (IRAP), Outsourced Service Provider’s Audit Report (OSPAR), ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, ISO 9001, Payment Card Industry Data Security Standard (PCI-DSS), or System and Organization Control (SOC).
• View details of AWS’s compliance program and report in AWS Artifact.