-: So, let's talk about the differences
between the SSM Parameter Store and Secrets Manager.
So, secrets manager is more expensive
and you're going to have the automation
of the rotation of the secrets using Lambda functions.
Some of these Lambda functions
are going to be provided out of the box,
for example, for RDS, for Redshift or DocumentDB
that have strong integrations with Secrets Manager.
So, it saves you a little bit of time.
KMS encryption is going to be mandatory for your secrets
and you can integrate them with CloudFormation.
The Parameter Store has a more,
has a wider type of use case and is less expensive.
It has a simple API.
There is no secrets rotation,
although, I will show you in the next slide,
how you can enable rotation on your own
using a Lambda function triggered by CloudWatch events,
but this is not a nature feature.
KMS encryption is going to be optional
because you can store secrets
or just parameters in the Parameter Store.
And it also has integration CloudFormation,
and it is possible for you to pull a Secrets Manager
from a secret, from secrets manager
using the SSM Parameter Store API,
the CW events,
But so, if you have a look at rotation of secrets
between the Parameter Store and Secrets Manager,
well, first for Secrets Manager,
say, we want to rotate the password
of an Amazon RDS database.
Therefore, we are going to set up Secrets Manager
to automatically invoke every 30 days in Lambda function.
Now, there's another function,
for example, for RDS, is provided by AWS
and is deployed in your accounts by AWS,
you just need to use it using Secrets Manager.
What it will do is that it will change the password
of your Amazon RDS database.
So, this is a nature functionality.
And in case it is just a random secrets
that is not deeply integrated with Secrets Manager,
then you need to write your own Lambda function for it.
But again, the documentation is provided by AWS.
Now, for the SSM Parameter Store,
there is no natured feature to the rotation,
but let's say, you were storing an RDS database password
into the SSM Parameter Store,
then what I would do is to create a CloudWatch events rule
that would be invoked every 30 days,
and that will invoke a Lambda function
that you would have to write on your own
to change the password of your Amazon RDS database,
and also to change the value in it,
that is stored in your SSM Parameter Store.
So, hopefully that makes sense
into what are the differences
between the Secrets Manager and the SSM Parameter Store.
I hope you liked this lecture
and I will see you in the next lecture.