What is the difference between Secrets Manager and SSM Parameter Store?
AWS · Advanced level
Answer
Secrets Manager is best for secrets needing rotation and version staging. SSM Parameter Store is often simpler for hierarchical configuration, feature flags, AMI IDs, and lower-rotation SecureString parameters.
Technical explanation
Parameter Store is strong for hierarchical config paths; Secrets Manager is stronger for secret lifecycle and rotation.
Key and secret controls must combine IAM policy, resource policy, KMS key policy, rotation, audit logging, and application refresh behavior.
Do not confuse encryption with authorization: encrypted data is still exposed if decrypt and read permissions are too broad.
Secret rotation must include monitoring and rollback because a failed rotation can become a production outage.
Hands-on example
1. Create a test KMS key, secret or parameter, IAM role, and workload that retrieves the value at runtime.
2. Scope permissions to the specific secret/parameter and KMS key, then test allowed and denied reads.
3. If rotation is relevant, run a manual rotation and confirm the application refreshes safely.
4. Add CloudTrail/CloudWatch alarms for failed rotation, denied decrypts, and suspicious access.
Check how well your resume matches the role with our free resume checker— match score, ATS check, and the skills you're missing.
More AWS interview questions
- What is the AWS shared responsibility model, and where is the line between AWS and the customer?
- Explain the difference between a Region, an Availability Zone, and an Edge Location.
- What is a VPC, and what are its core components (subnets, route tables, IGW, NAT)?
- Difference between a public and a private subnet, and how does each reach the internet?
- What is the difference between a Security Group and a Network ACL?
- Are Security Groups stateful or stateless? What about NACLs?
- What is an Internet Gateway versus a NAT Gateway, and when do you need each?
- How does a NAT Gateway differ from a NAT instance?