Secrets & Configuration Management FAQs

Question 1

Why use one secret per service instead of individual parameters?

Accepted Answer

Storing all service-specific configuration in one JSON blob simplifies IAM policies, reduces Terraform management overhead, and ensures that all environment variables are fetched in a single access pattern.

Question 2

When should I use Parameter Store versus Secrets Manager?

Accepted Answer

Use Secrets Manager for application-level secrets and configuration. Use Parameter Store only for infrastructure wiring, such as passing VPC IDs or database endpoints between different Terraform modules.

Question 3

How should database users be managed according to this skill?

Accepted Answer

It recommends role-based users (e.g., api_rw, dashboard_ro) rather than person-specific accounts. Developer access is then handled via SSO and a database proxy using shared read-only roles for better security and instant offboarding.

Question 4

How does this skill handle different environments like dev and prod?

Accepted Answer

It utilizes account-based isolation where the secret path remains identical (e.g., /myapp/env) across all environments. The cloud account itself provides the separation, allowing application code to remain environment-agnostic.

Secrets & Configuration Management

Key Features

Use Cases

Secrets & Configuration Management

Key Features

Use Cases