Data protection in Amazon Secrets Manager - Amazon Secrets Manager
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Data protection in Amazon Secrets Manager

The Amazon shared responsibility model applies to data protection in Amazon Secrets Manager. As described in this model, Amazon is responsible for protecting the global infrastructure that runs all of the Amazon Web Services Cloud. You are responsible for maintaining control over your content that is hosted on this infrastructure. This content includes the security configuration and management tasks for the Amazon Web Services that you use. For more information about data privacy, see the Data Privacy FAQ.

For data protection purposes, we recommend that you protect Amazon Web Services account credentials and set up individual user accounts with Amazon Identity and Access Management (IAM). That way each user is given only the permissions necessary to fulfill their job duties. We also recommend that you secure your data in the following ways:

Encryption at rest

Secrets Manager uses encryption via Amazon Key Management Service (Amazon KMS) to protect the confidentiality of data at rest. Amazon KMS provides a key storage and encryption service used by many Amazon services. Every secret in Secrets Manager is encrypted with a unique data key. Each data key is protected by a KMS key. You can choose to use default encryption with the Secrets Manager Amazon managed key for the account, or you can create your own customer managed key in Amazon KMS. Using a customer managed key gives you more granular authorization controls over your KMS key activities. For more information, see Secret encryption and decryption in Amazon Secrets Manager.

Encryption in transit

Secrets Manager provides secure and private endpoints for encrypting data in transit. The secure and private endpoints allows Amazon to protect the integrity of API requests to Secrets Manager. Amazon requires API calls be signed by the caller using X.509 certificates and/or a Secrets Manager Secret Access Key. This requirement is stated in the Signature Version 4 Signing Process (Sigv4).

If you use the Amazon Command Line Interface (Amazon CLI) or any of the Amazon SDKs to make calls to Amazon, you configure the access key to use. Then those tools automatically use the access key to sign the requests for you. See Mitigate the risks of using the Amazon CLI to store your Amazon Secrets Manager secrets.

Inter-network traffic privacy

Amazon offers options for maintaining privacy when routing traffic through known and private network routes.

Traffic between service and on-premises clients and applications

You have two connectivity options between your private network and Amazon Secrets Manager:

Traffic between Amazon resources in the same Region

If you want to secure traffic between Secrets Manager and API clients in Amazon, set up an Amazon PrivateLink to privately access Secrets Manager API endpoints.

Encryption key management

When Secrets Manager needs to encrypt a new version of the protected secret data, Secrets Manager sends a request to Amazon KMS to generate a new data key from the KMS key. Secrets Manager uses this data key for envelope encryption. Secrets Manager stores the encrypted data key with the encrypted secret. When the secret needs to be decrypted, Secrets Manager asks Amazon KMS to decrypt the data key. Secrets Manager then uses the decrypted data key to decrypt the encrypted secret. Secrets Manager never stores the data key in unencrypted form and removes the key from memory as soon as possible. For more information, see Secret encryption and decryption in Amazon Secrets Manager.