‫So, let's talk about the differences
‫between the SSM Parameter Store and Secrets Manager.
‫So, secrets manager is more expensive
‫and you're going to have the automation
‫of the rotation of the secrets using Lambda functions.
‫Some of these Lambda functions
‫are going to be provided out of the box,
‫for example, for RDS, for Redshift or DocumentDB
‫that have strong integrations with Secrets Manager.
‫So, it saves you a little bit of time.
‫KMS encryption is going to be mandatory for your secrets
‫and you can integrate them with CloudFormation.
‫The Parameter Store has a more,
‫has a wider type of use case and is less expensive.
‫It has a simple API.
‫There is no secrets rotation,
‫although, I will show you in the next slide,
‫how you can enable rotation on your own
‫using a Lambda function triggered by CloudWatch events,
‫but this is not a nature feature.
‫KMS encryption is going to be optional
‫because you can store secrets
‫or just parameters in the Parameter Store.
‫And it also has integration CloudFormation,
‫and it is possible for you to pull a Secrets Manager
‫from a secret, from secrets manager
‫using the SSM Parameter Store API,
‫the CW events,
‫But so, if you have a look at rotation of secrets
‫between the Parameter Store and Secrets Manager,
‫well, first for Secrets Manager,
‫say, we want to rotate the password
‫of an Amazon RDS database.
‫Therefore, we are going to set up Secrets Manager
‫to automatically invoke every 30 days in Lambda function.
‫Now, there's another function,
‫for example, for RDS, is provided by AWS
‫and is deployed in your accounts by AWS,
‫you just need to use it using Secrets Manager.
‫What it will do is that it will change the password
‫of your Amazon RDS database.
‫So, this is a nature functionality.
‫And in case it is just a random secrets
‫that is not deeply integrated with Secrets Manager,
‫then you need to write your own Lambda function for it.
‫But again, the documentation is provided by AWS.
‫Now, for the SSM Parameter Store,
‫there is no natured feature to the rotation,
‫but let's say, you were storing an RDS database password
‫into the SSM Parameter Store,
‫then what I would do is to create a CloudWatch events rule
‫that would be invoked every 30 days,
‫and that will invoke a Lambda function
‫that you would have to write on your own
‫to change the password of your Amazon RDS database,
‫and also to change the value in it,
‫that is stored in your SSM Parameter Store.
‫So, hopefully that makes sense
‫into what are the differences
‫between the Secrets Manager and the SSM Parameter Store.
‫I hope you liked this lecture
‫and I will see you in the next lecture.