<story><title>AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely</title><url>https://aws.amazon.com/blogs/aws/aws-secrets-manager-store-distribute-and-rotate-credentials-securely/</url></story><parent_chain><item><author>scrollaway</author><text>First reaction: Holy crap! They finally turned ParameterStore into a proper product!&lt;p&gt;Second reaction: Holy shit that&amp;#x27;s expensive [for what it does].&lt;p&gt;ParameterStore is free (minus the KMS component). The only value-add is secret rotation and that&amp;#x27;s not something that most of the time makes sense to use. [Edit: I&amp;#x27;m not advocating for no rotation; see replies]&lt;p&gt;Edit: Had more time to think about it. Someone enlighten me: What&amp;#x27;s the difference between writing a rotation lambda for this new product, vs. writing a rotation lambda for ParameterStore that you then cron? The pricing really doesn&amp;#x27;t make sense.</text></item></parent_chain><comment><author>Dunedan</author><text>My biggest criticism of Parameter Store is actually that it&amp;#x27;s free. Let me explain:&lt;p&gt;Because it&amp;#x27;s free they limit the requests per seconds you can make to the Parameter Store. That&amp;#x27;s especially noticeable when doing requests for all parameters of a given path, as the limit is way lower there than for requesting (a bunch of) individual parameters. In the past that caused serious problems for us when using Parameter Store for AWS Lambda functions during a deploy of new versions of functions, as suddenly there was a spike in the number of requests to Parameter Store as all AWS Lambda containers got replaced.&lt;p&gt;They of course set such limits because it&amp;#x27;s free, so I&amp;#x27;d gladly pay for getting increased limits.</text></comment>
<story><title>AWS Secrets Manager – Store, Distribute, and Rotate Credentials Securely</title><url>https://aws.amazon.com/blogs/aws/aws-secrets-manager-store-distribute-and-rotate-credentials-securely/</url></story><parent_chain><item><author>scrollaway</author><text>First reaction: Holy crap! They finally turned ParameterStore into a proper product!&lt;p&gt;Second reaction: Holy shit that&amp;#x27;s expensive [for what it does].&lt;p&gt;ParameterStore is free (minus the KMS component). The only value-add is secret rotation and that&amp;#x27;s not something that most of the time makes sense to use. [Edit: I&amp;#x27;m not advocating for no rotation; see replies]&lt;p&gt;Edit: Had more time to think about it. Someone enlighten me: What&amp;#x27;s the difference between writing a rotation lambda for this new product, vs. writing a rotation lambda for ParameterStore that you then cron? The pricing really doesn&amp;#x27;t make sense.</text></item></parent_chain><comment><author>toomuchtodo</author><text>&amp;gt; The only value-add is secret rotation and that&amp;#x27;s not something that most of the time makes sense to use.&lt;p&gt;From a security perspective, you should be rotating secrets somewhere between annually and every 90 days, depending on your business&amp;#x2F;security&amp;#x2F;compliance requirements and the nature of the data secured by the secret.</text></comment>