SSM Parameter Store Vs Secret Manager
| AWS SSM Parameter Store | AWS Secrets Manager |
|---|---|
| Automatic rotation of secret | No automatic rotation |
| KMS is mandatory | KMS is optional |
| Seamlessly integrate with RDS, Redshift, DocumentDB, CloudFormation | Integrate with CloudFormation |
| Can Pull AWS Secrets Manager secret using API |
Integration with RDS For example
AWS Secrets Manager (Newer)
Write an AWS Lambda function (AWS Provided) to trigger change password for RDS
SSM Parameter store
Use CloudWatch Events to invoke a custom AWS Lambda to change passwords in both RDS and SSM Parameter Store