World map

 

BM

World A4: Containers in the Cloud

Secrets Manager and Parameter Store

You will learn: to keep passwords in a safe, hand them to tasks at start, and give only the right key.

Checked with AWS 2026-11 on 1 Nov 2026

The problem

The database password sits in plain text in the task definition. Everyone who can read the recipe card can read the password. What now?

Watch

Secrets Manager: A safe for passwords and keys. It can change them on a schedule. Each secret has a monthly charge. is the safe. Parameter Store: A noticeboard for settings, with locked notes (SecureString) for secrets. Part of Systems Manager. is a noticeboard with locked notes. Which fits each job?

Drag a card into a box. Or tap the card, then tap the box.

      Watch

      The recipe card points at the safe. ECS opens it when the task starts. Tap the line that says where the password comes from.

      Tap the line that names the safe.

      0 of 1 found

      Try it

      The task’s execution role must open the database safe. Its key points at the wrong one. Change the pink line, and keep it narrow.

      Change the pink line so AWS says Allow.

      The request

      Who
      kedai-task-exec (role session)arn:aws:sts::111122223333:assumed-role/kedai-task-exec/web-1
      Wants to
      secretsmanager:GetSecretValue
      On
      arn:aws:secretsmanager:ap-southeast-5:111122223333:secret:kedai-db-a1b2c3
      Identity policy (key ring) · read-one-secret
      {
      "Version": "2012-10-17",
      "Statement": [
      {
      "Effect": "Allow",
      "Action": "secretsmanager:GetSecretValue",
      }
      ]
      }

      Predict

      The safe changes the password tonight. A task started yesterday is still running. Which password does it have?

      Check

      Safe secret habits, or risky? Swipe right for safe.

      Swipe right for good, left for needs work. Or use the buttons.

      1 / 4

      Put the secret’s address on the recipe card

      You did it!

      You can now keep secrets in a safe, for the right task only.

      Go deeper (optional)

      Deleting a secret waits a recovery window first, so you can undo a mistake. Here is the official example’s answer.

      bash
      aws secretsmanager delete-secret --secret-id MyTestSecret --recovery-window-in-days 7
      {
      "ARN": "arn:aws:secretsmanager:us-west-2:123456789012:secret:MyTestSecret-a1b2c3",
      "Name": "MyTestSecret",
      "DeletionDate": 1524085349.095
      }