Secrets Manager

Secrets Manager is where the API keys and the DB passwords actually live on AWS (L275) — the secrets (the Bedrock keys L278, the database passwords L268, the third-party keys L227, L275), the rotation (the scheduled replacement: the new value generated and the dependent services updated, L275), the access (the IAM-scoped reads: the Lambda's role L262 may read its secrets and nothing else, L262), and the caching (the client-side cache: the read once, the cache with the refresh, L275) — the L321 rule — the secrets never reach the client (L321) — AWS-shaped (L275).

The one-sentence interview answer: "Secrets Manager is AWS's secret store (L275). The secret: the value with the metadata — the Bedrock keys (L278), the database passwords (L268), the third-party API keys (L227) (L275). The rotation: the scheduled replacement (L275) — the Lambda (L266) generates the new value, updates the service, and the secret rotates (L275); the clients (L275) fetch the new value on the next read (L275). The access: the IAM (L262) — the Lambda's execution role (L262) may read the secret it needs and nothing else (L275). The caching: the client caches the secret (L275) and refreshes it periodically (L275) — the read (L275) isn't on the hot path (L151). The AI shape: the app never holds the keys (L275): the Lambda (L266) reads the Bedrock key (L278) from the secret store at the cold start (L266), the database password (L268) from the secret store (L275), and the third-party keys (L227) the same (L275) — the L321 rule — the secrets never reach the client (L321) — AWS-shaped (L275)."

Think of Secrets Manager as the bank's safe-deposit boxes. The boxes (the secrets, L275) hold the valuables: the master keys (the API keys, L278), the vault combos (the DB passwords, L268) — each in its own box (L275). The access is the badge-scoped (the IAM, L262): the floor manager (the Lambda, L266) may open the boxes it needs and nothing else (L262). The combinations change on the schedule (the rotation, L275): the bank issues the new combos (L275), and the floor managers (the services, L266) learn them on the next shift (L275). And the floor managers don't carry the valuables around (the caching, L275): they memorize the combo once (L275) and refresh it when it changes (L275). The bank works because the boxes are scoped, the combos rotate, and the valuables never leave the vault (L275).

   the safe-deposit vault (Secrets Manager, L275)
   ┌────────────────────────────────────────────────────────┐
   │ the boxes (the secrets, L275) — the keys (L278), the   │
   │ passwords (L268)                                       │
   │ the badges (the IAM, L262) — the scoped reads          │
   │ the rotation (L275) — the scheduled replacement        │
   │ the memory (the caching, L275) — the client-side cache │
   └────────────────────────────────────────────────────────┘

The mental model is the vault: the boxes, the badges, the rotation, and the memory (L275).

   the secret is stored (L275)
        │
        ▼
   ┌────────────────────── THE ACCESS (L262) ──────────────────────────┐
   │  the Lambda (L266) assumes its role (L262)                       │
   │  the role may read the secret it needs — and nothing else (L275) │
   └──────────────────────────┬───────────────────────────────────────┘
                              ▼
   ┌────────────────────── THE READ (L275) ────────────────────────────┐
   │  the cold start (L266) fetches the secret (L275)                 │
   │  the client caches it (L275) — the hot path (L151) never reads   │
   └──────────────────────────┬───────────────────────────────────────┘
                              ▼
   ┌────────────────────── THE ROTATION (L275) ────────────────────────┐
   │  the schedule (L275) → the rotation Lambda (L266)                │
   │  the new value generated, the service updated (L275)             │
   │  the clients refresh on the next read (L275)                     │
   └──────────────────────────────────────────────────────────────────┘

The flow is the secret's life: store → scoped access → cached read → rotate (L275).

• The secrets (L275). The values with the metadata (L275): the Bedrock keys (L278), the database passwords (L268), the third-party keys (L227) (L275). Each secret is its own entry with its own access (L275).
• The rotation (L275). The scheduled replacement (L275): the rotation Lambda (L266) generates the new value, updates the dependent service, and the secret rotates (L275). The rotation is the breach's containment (L275): the leaked key expires (L275).
• The access (L262). The IAM-scoped reads (L262): the Lambda's execution role (L262) may read the secrets it needs and nothing else (L275). The secret is the least-privilege's object (L262).
• The caching (L275). The client-side cache (L275): the secret fetched at the cold start (L266), cached, and refreshed periodically (L275) — the hot path (L151) never reads the store (L275).
• The comparison (L275). The Parameter Store vs Secrets Manager (L275): the Parameter Store for the config (L300), the Secrets Manager for the secrets with the rotation (L275).

• A serverless AI stack (L283). The Lambda (L266) reads the Bedrock key (L278) from the secret store (L275) at the cold start (L266) — the key never in the code (L275).
• A production database (L268). The RDS password (L268) in the secret store (L275), rotated on the schedule (L275) — the RDS-managed rotation (L275).
• A third-party integration (L227). The Stripe and the CRM keys (L227) in the secret store (L275), scoped to the integrating Lambda (L262).
• A multi-tenant SaaS (L357). The per-tenant secrets (L320) — the per-tenant keys (L320) in the secret store (L275).
• Anything with a key (L275). The secrets live in the vault (L275) — never in the code, never in the image (L301), never in the client (L321).

The through-line: the vault is the secrets' home — scoped, rotated, and cached (L275).

Say it in four moves:

1. The secret. "The API keys (L278), the DB passwords (L268), the third-party keys (L227)."
2. The access. "The IAM-scoped reads (L262) — the role reads what it needs (L275)."
3. The rotation. "The scheduled replacement — the leaked value expires (L275)."
4. The cache. "The cold-start fetch (L266), the client cache (L275) — the hot path never reads (L151)."

• The secret store is the L321 payoff (L275). The L321 rule (L321) — the secrets never reach the client (L321) — is the vault's boundary (L275): the app never holds the keys (L275).
• The rotation is the breach's containment (L275). The scheduled replacement (L275) — the leaked key (L275) expires (L275) — the breach's blast radius (L314) bounded (L275).
• The access is the least privilege's object (L262). The role may read the secret it needs (L275) and nothing else (L262) — the L262 discipline, secret-shaped (L275).
• The cache is the latency's design (L151). The cold-start fetch (L266) and the client cache (L275) — the hot path (L151) never pays the read (L275).
• The Parameter Store is the config's home (L300). The config (L300) in the Parameter Store (L275), the secrets in the Secrets Manager (L275) — the split is the senior's (L275).

• The key in the code (L275). The hardcoded key (L275) — the L321 rule (L321) broken, the key in the repo (L301).
• The key in the image (L275). The secret baked into the container (L301) — the image (L293) is public (L301).
• The key in the client (L275). The NEXT_PUBLIC_ key (L96) — the L321 rule (L321): the secrets never reach the client (L275).
• No rotation (L275). The static key (L275) — the leaked value (L275) lives forever (L275).
• The unscoped reads (L262). The role with the secretsmanager:* (L262) — the least privilege (L262) lost.

• Store every key (L275) — the Bedrock (L278), the RDS (L268), the third-party (L227).
• Scope the reads (L262) — the role reads what it needs (L275).
• Rotate on the schedule (L275) — the leaked value expires (L275).
• Cache the secret (L275) — the cold-start fetch (L266), the refresh (L275).
• Keep the keys out of the client (L321) — the L321 rule (L321), AWS-shaped (L275).

Q: Walk me through Secrets Manager.

A: The secret store (L275). The secrets — the API keys (L278), the DB passwords (L268), the third-party keys (L227). The access — the IAM-scoped reads (L262). The rotation — the scheduled replacement (L275). And the caching — the client-side cache, the hot path (L151) never reads (L275).

Q: How does the Lambda get the Bedrock key?

A: From the secret store (L275): the Lambda (L266) assumes its execution role (L262), reads the secret at the cold start (L266), and caches it (L275) — the key never in the code (L275) and never in the image (L301).

Q: What's the rotation for?

A: The breach's containment (L275). The scheduled rotation (L275) generates the new value and updates the dependent service (L275) — a leaked key (L275) expires (L275), and the blast radius (L314) is bounded (L275).

Q: Where do the secrets never go?

A: The client (L321). The L321 rule (L321): the secrets never reach the client (L321) — no NEXT_PUBLIC_ key (L96), no key in the bundle (L275). The server reads from the vault (L275); the client never sees a secret (L321).

• What are the secrets (L275)?
• What's the rotation (L275)?
• What's the access (L262)?
• What's the caching (L275)?
• Where do the secrets never go (L321)?

The senior read: the secrets rotate; the config doesn't — the split is the senior's (L275).

// The vault access (L275) — the scoped, cached read (L275).
// THE COLD START (L266) — the secret fetched once (L275).
let cachedBedrockKey;                          // the client cache (L275)
let cacheExpiresAt = 0;

async function getBedrockKey() {
  // 1 · THE CACHE (L275) — the hot path (L151) never reads.
  const now = Date.now();
  if (cachedBedrockKey && now < cacheExpiresAt) {
    return cachedBedrockKey;                   // the cached value (L275)
  }

  // 2 · THE READ (L275) — the role (L262) scopes the access.
  const secret = await secretsManager.getSecretValue({
    secretId: 'bedrock-api-key',               // the secret (L278)
  });
  cachedBedrockKey = secret.SecretString;      // the cache fill (L275)
  cacheExpiresAt = now + 15 * 60 * 1000;       // the 15-min refresh (L275)
  return cachedBedrockKey;
}

// 3 · THE ROTATION (L275) — the schedule replaces the value (L275);
//    the cache's expiry picks up the new value on the next read (L275).

// The L321 rule (L321): the key never reaches the client (L275) —
// this code runs only on the server (L96).

What the reader must SEE — the vault, accessed:

  secretId: 'bedrock-api-key'  → the secret (L278, L275)
  getSecretValue               → the scoped read (L262, L275)
  cached + 15-min refresh      → the hot path never reads (L151, L275)
  the rotation picks up on the refresh (L275)
  the server only               → the L321 rule (L321)

  Scoped, cached, rotated — and never in the client (L275).

• The cache is the latency's design (L151). The cold-start fetch (L266) and the client cache (L275) — the hot path (L151) never pays the read (L275).
• The rotation is the availability's edge (L275). The rotation's window (L275) — the dependent service (L266) must handle the new value (L275).
• The read is the cost (L285). The per-request pricing (L285) — the cache (L275) keeps the reads (L285) low (L275).
• The secret is the cold start's cost (L266). The fetch (L275) adds to the cold start (L266) — the cache (L275) bounds it (L275).

• Secrets Manager = the secret store (L275): the secrets, the rotation, the access, the caching.
• The secrets: the Bedrock keys (L278), the DB passwords (L268), the third-party keys (L227).
• The rotation: the scheduled replacement (L275) — the leaked value expires.
• The access: the IAM-scoped reads (L262).
• The rule: the secrets never reach the client (L321).

SECRETS MANAGER = where the API keys and the DB passwords live

THE SECRETS (L275)
  the Bedrock keys (L278) · the RDS passwords (L268)
  the third-party keys (L227) — each its own entry (L275)

THE ACCESS (L262)
  the IAM-scoped reads — the role reads what it needs (L275)
  the least privilege (L262), secret-shaped (L275)

THE ROTATION (L275)
  the scheduled replacement (L275)
  the rotation Lambda (L266) generates + updates (L275)
  the leaked value expires (L275)

THE CACHING (L275)
  the cold-start fetch (L266) · the client cache (L275)
  the hot path (L151) never reads (L275)

THE RULE (L321)
  the secrets never reach the client (L321)
  no NEXT_PUBLIC_ key (L96) · no key in the image (L301)

INTERVIEW, 4 MOVES
  1 secrets "the keys, the passwords, the third-party (L275)"
  2 access  "the IAM-scoped reads (L262)"
  3 rotation "the scheduled replacement (L275)"
  4 rule    "the secrets never reach the client (L321)"

You now hold the secret store: the secrets, the rotation, the access, and the caching — with the L321 rule as the vault's boundary. The backend has its keys — and they live in the vault, never in the client (L275).

Next: the AWS event bus that wires the services together — EventBridge (L276).