--- title: AWS Secrets Manager vs. KMS: Understanding the Difference description: AWS Secrets Manager and AWS KMS solve different problems despite both protecting sensitive values: Secrets Manager stores and rotates application credentials... canonical: https://daily.dev/posts/aws-secrets-manager-vs-kms-understanding-the-difference-dcdvdfe5f twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AWS Secrets Manager vs. KMS: Understanding the Difference | daily.dev og:description: AWS Secrets Manager and AWS KMS solve different problems despite both protecting sensitive values: Secrets Manager stores and rotates application credentials... og:url: https://daily.dev/posts/aws-secrets-manager-vs-kms-understanding-the-difference-dcdvdfe5f og:image: https://api.daily.dev/og/posts/dCdvdFE5F.png og:image:alt: AWS Secrets Manager vs. KMS: Understanding the Difference og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AWS Secrets Manager vs. KMS: Understanding the Difference **[Infisical](https://daily.dev/sources/infisical)** · 7 min read · 1 upvotes · 0 comments ## Summary AWS Secrets Manager and AWS KMS solve different problems despite both protecting sensitive values: Secrets Manager stores and rotates application credentials like API keys and database passwords, while KMS creates and manages the encryption keys used to protect data, including the secrets stored inside Secrets Manager itself. Every secret in Secrets Manager is encrypted via envelope encryption using a KMS key (AWS managed by default, or customer managed). Most engineers never interact with KMS directly unless they need to encrypt objects outside Secrets Manager, build custom envelope encryption, or meet compliance requirements demanding customer managed keys. The piece also covers when organizations outgrow AWS-native tooling (multi-cloud, KMIP requirements, unified governance) and positions Infisical as a tool that can sync with or replace AWS Secrets Manager/KMS. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the difference between AWS Secrets Manager and AWS KMS? AWS Secrets Manager stores and rotates application credentials such as API keys, OAuth tokens, and database passwords that applications need to authenticate. AWS KMS creates and manages the encryption keys used to encrypt other data, including the secrets stored inside Secrets Manager itself. Every secret in Secrets Manager is encrypted with a KMS key via envelope encryption, either AWS managed by default or customer managed. _daily.dev surfaces practical comparisons like this for engineers deciding between AWS security services._ ### Do I need to manually manage AWS KMS if I'm using AWS Secrets Manager? No, most engineers never need to touch KMS directly when using Secrets Manager, since the AWS managed key handles encryption automatically under the hood. Manual KMS involvement becomes necessary when encrypting objects outside Secrets Manager like S3 buckets or EBS volumes, building custom envelope encryption, or when compliance requires a customer managed key with specific policies. _Engineers wiring up AWS credentials can track these operational nuances through daily.dev._ ### When should I use a third-party secrets manager instead of AWS Secrets Manager and KMS? Consider a dedicated tool like Infisical when infrastructure spans multiple clouds or includes on-premises systems, when a security team wants one governance layer instead of per-environment tooling, or when standardizing on KMIP, since AWS KMS doesn't speak KMIP. AWS Secrets Manager also lacks native dynamic secrets, requiring custom Lambda-based rotation built from scratch. _Teams weighing multi-cloud secrets strategies can follow this kind of tooling comparison on daily.dev._ ## Similar posts on daily.dev - [Terraform Secrets Management Best Practices: Secret Managers and Ephemeral Resources](https://daily.dev/posts/terraform-secrets-management-best-practices-secret-managers-and-ephemeral-resources-vslu5iakb) · GitGuardian · 0 upvotes · 0 comments - [Apache Iceberg Table Encryption with KMS](https://daily.dev/posts/apache-iceberg-table-encryption-with-kms-nu5cd83l2) · Dremio Blog · 0 upvotes · 0 comments - [Amazon Transcribe adds customer-managed KMS keys for custom resources](https://daily.dev/posts/amazon-transcribe-adds-customer-managed-kms-keys-for-custom-resources-ye35lx3tw) · AWS · 0 upvotes · 0 comments - [Cloud Database Encryption Keys and CMEK](https://daily.dev/posts/cloud-database-encryption-keys-and-cmek-xq65pt4ui) · SingleStore · 4 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws), [#encryption](https://daily.dev/tags/encryption), [#secrets-management](https://daily.dev/tags/secrets-management) [View this post on daily.dev](https://daily.dev/posts/aws-secrets-manager-vs-kms-understanding-the-difference-dcdvdfe5f) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"AWS Secrets Manager vs. KMS: Understanding the Difference","url":"https://daily.dev/posts/aws-secrets-manager-vs-kms-understanding-the-difference-dcdvdfe5f","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/aws-secrets-manager-vs-kms-understanding-the-difference-dcdvdfe5f"},"datePublished":"2026-10-04T06:43:22.938Z","dateModified":"2026-10-04T06:43:48.616Z","description":"AWS Secrets Manager and AWS KMS solve different problems despite both protecting sensitive values: Secrets Manager stores and rotates application credentials...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7c4ffadd0ed5b729045bf1270065c7e5?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7c4ffadd0ed5b729045bf1270065c7e5?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Infisical","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Infisical","logo":"https://media.daily.dev/image/upload/s--cBUOmyKi--/f_auto/v1791096186/squads/35883724-c141-4779-850e-50db106017fd?_a=BAMAMicg0","url":"https://daily.dev/squads/infisical"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/aws-secrets-manager-vs-kms-understanding-the-difference-dcdvdfe5f","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"aws,encryption,secrets-management","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Infisical","item":"https://daily.dev/squads/infisical"},{"@type":"ListItem","position":3,"name":"AWS Secrets Manager vs. KMS: Understanding the Difference"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/aws-secrets-manager-vs-kms-understanding-the-difference-dcdvdfe5f#faq","mainEntity":[{"@type":"Question","name":"What is the difference between AWS Secrets Manager and AWS KMS?","acceptedAnswer":{"@type":"Answer","text":"AWS Secrets Manager stores and rotates application credentials such as API keys, OAuth tokens, and database passwords that applications need to authenticate. AWS KMS creates and manages the encryption keys used to encrypt other data, including the secrets stored inside Secrets Manager itself. Every secret in Secrets Manager is encrypted with a KMS key via envelope encryption, either AWS managed by default or customer managed. daily.dev surfaces practical comparisons like this for engineers deciding between AWS security services."}},{"@type":"Question","name":"Do I need to manually manage AWS KMS if I'm using AWS Secrets Manager?","acceptedAnswer":{"@type":"Answer","text":"No, most engineers never need to touch KMS directly when using Secrets Manager, since the AWS managed key handles encryption automatically under the hood. Manual KMS involvement becomes necessary when encrypting objects outside Secrets Manager like S3 buckets or EBS volumes, building custom envelope encryption, or when compliance requires a customer managed key with specific policies. Engineers wiring up AWS credentials can track these operational nuances through daily.dev."}},{"@type":"Question","name":"When should I use a third-party secrets manager instead of AWS Secrets Manager and KMS?","acceptedAnswer":{"@type":"Answer","text":"Consider a dedicated tool like Infisical when infrastructure spans multiple clouds or includes on-premises systems, when a security team wants one governance layer instead of per-environment tooling, or when standardizing on KMIP, since AWS KMS doesn't speak KMIP. AWS Secrets Manager also lacks native dynamic secrets, requiring custom Lambda-based rotation built from scratch. Teams weighing multi-cloud secrets strategies can follow this kind of tooling comparison on daily.dev."}}]} ```