# Data protection in Amazon Secrets Manager
The Amazon [shared responsibility model](https://aws.amazon.com/compliance/shared-responsibility-model/) applies to data protection in Amazon Secrets Manager. As described in this model, Amazon is responsible for protecting the global infrastructure that runs all of the Amazon Web Services Cloud. You are responsible for maintaining control over your content that is hosted on this infrastructure. This content includes the security configuration and management tasks for the Amazon Web Services services that you use. For more information about data privacy, see the [Data Privacy FAQ](https://www.amazonaws.cn/compliance/data-privacy-faq).
For data protection purposes, we recommend that you protect Amazon Web Services account credentials and set up individual user accounts with Amazon Identity and Access Management (IAM). That way each user is given only the permissions necessary to fulfill their job duties. We also recommend that you secure your data in the following ways:
+ Use [multi-factor authentication (MFA)](https://docs.amazonaws.cn/IAM/latest/UserGuide/best-practices.html#enable-mfa-for-privileged-users) with each account.
+ Use SSL/TLS to communicate with Amazon resources. Secrets Manager supports TLS 1.2 and 1.3 in all Regions. Secrets Manager also supports a hybrid [post-quantum key exchange option for TLS (PQTLS)](pqtls.md) network encryption protocol.
+ Sign your programmatic requests to Secrets Manager by using an access key ID and a secret access key associated with an IAM principal. Or you can use [Amazon Security Token Service](https://docs.amazonaws.cn/STS/latest/APIReference/Welcome.html) (Amazon STS) to generate temporary security credentials to sign requests.
+ Set up API and user activity logging with Amazon CloudTrail. See [Log Amazon Secrets Manager events with Amazon CloudTrail](monitoring-cloudtrail.md).
+ If you require FIPS 140-2 validated cryptographic modules when accessing Amazon through a command line interface or an API, use a FIPS endpoint. See [Amazon Secrets Manager endpoints](asm_access.md#endpoints).
+ If you use the Amazon CLI to access Secrets Manager, [Mitigate the risks of using the Amazon CLI to store your Amazon Secrets Manager secrets](security_cli-exposure-risks.md).
## Encryption at rest
Secrets Manager uses encryption via Amazon Key Management Service (Amazon KMS) to protect the confidentiality of data at rest. Amazon KMS provides a key storage and encryption service used by many Amazon services. Every secret in Secrets Manager is encrypted with a unique data key. Each data key is protected by a KMS key. You can choose to use default encryption with the Secrets Manager Amazon managed key for the account, or you can create your own customer managed key in Amazon KMS. Using a customer managed key gives you more granular authorization controls over your KMS key activities. For more information, see [Secret encryption and decryption in Amazon Secrets Manager](security-encryption.md).
## Encryption in transit
Secrets Manager provides secure and private endpoints for encrypting data in transit. The secure and private endpoints allows Amazon to protect the integrity of API requests to Secrets Manager. Amazon requires API calls be signed by the caller using X.509 certificates and/or a Secrets Manager Secret Access Key. This requirement is stated in the [Signature Version 4 Signing Process](https://docs.amazonaws.cn/general/latest/gr/signature-version-4.html) (Sigv4).
If you use the Amazon Command Line Interface (Amazon CLI) or any of the Amazon SDKs to make calls to Amazon, you configure the access key to use. Then those tools automatically use the access key to sign the requests for you. See [Mitigate the risks of using the Amazon CLI to store your Amazon Secrets Manager secrets](security_cli-exposure-risks.md).
## Inter-network traffic privacy
Amazon offers options for maintaining privacy when routing traffic through known and private network routes.
**Traffic between service and on-premises clients and applications**
You have two connectivity options between your private network and Amazon Secrets Manager:
+ An Amazon Site-to-Site VPN connection. For more information, see [What is Amazon Site-to-Site VPN?](https://docs.amazonaws.cn/vpn/latest/s2svpn/VPC_VPN.html)
+ An Amazon Direct Connect connection. For more information, see [What is Amazon Direct Connect?](https://docs.amazonaws.cn/directconnect/latest/UserGuide/Welcome.html)
**Traffic between Amazon resources in the same Region**
If you want to secure traffic between Secrets Manager and API clients in Amazon, set up an [Amazon PrivateLink](https://aws.amazon.com/privatelink/) to privately access Secrets Manager API endpoints.
## Encryption key management
When Secrets Manager needs to encrypt a new version of the protected secret data, Secrets Manager sends a request to Amazon KMS to generate a new data key from the KMS key. Secrets Manager uses this data key for [envelope encryption](https://docs.amazonaws.cn/kms/latest/developerguide/concepts.html#enveloping). Secrets Manager stores the encrypted data key with the encrypted secret. When the secret needs to be decrypted, Secrets Manager asks Amazon KMS to decrypt the data key. Secrets Manager then uses the decrypted data key to decrypt the encrypted secret. Secrets Manager never stores the data key in unencrypted form and removes the key from memory as soon as possible. For more information, see [Secret encryption and decryption in Amazon Secrets Manager](security-encryption.md).