Who can do what, and how keys and credentials are kept: IAM, KMS and Secrets Manager.
Identity and secrets management decides who or what may call an AWS API and how sensitive values such as passwords, API keys and encryption keys are stored and released. Almost every other AWS security control depends on these three services being configured correctly.
AWS Identity and Access Management (IAM) is the foundational service for controlling who and what can access AWS resources. It manages users, groups, roles…
AWS Key Management Service (KMS) is a managed service for creating and controlling cryptographic keys backed by FIPS 140-2 validated hardware security…
AWS Secrets Manager stores, rotates, and retrieves secrets — database credentials, API keys, OAuth tokens — via a managed service with IAM-governed access…
IAM is the authorisation layer: every AWS API request is signed with credentials that map to a principal, and IAM evaluates identity policies, resource policies, permission boundaries and service control policies to allow or deny it. KMS manages encryption keys inside hardware security modules; keys never leave the service in plaintext, and every use of a key is itself an IAM-authorised, CloudTrail-logged API call. Secrets Manager stores secret values encrypted under a KMS key and can rotate them on a schedule with a Lambda function, so applications fetch the current value at runtime instead of baking it into code or configuration.
| Need | Service | Avoid |
|---|---|---|
| Grant a workload access to S3 or DynamoDB | IAM role | Long-lived access keys on disk |
| Encrypt data at rest with a key you control | KMS customer-managed key | Hand-rolled key storage |
| Store a database password that must rotate | Secrets Manager | Environment variables in source control |
| Store non-secret config values cheaply | SSM Parameter Store | Secrets Manager for plain config |
The common thread is to prefer short-lived, automatically issued credentials over static ones. Roles hand out temporary credentials, KMS keeps key material out of reach, and rotation limits how long a leaked secret stays useful. Policies should grant the narrowest set of actions and resources that the workload needs, and CloudTrail should be enabled so every key use and secret read can be audited.
See Network Security for perimeter and VPC controls and Detection for monitoring misuse of credentials.