One-line conclusion
- AWS KMS manages encryption keys.
- AWS Secrets Manager stores and rotates passwords, tokens, and API keys.
- AWS Certificate Manager manages SSL/TLS certificates used for HTTPS.
Core differences
| Dimension | KMS | Secrets Manager | ACM |
|---|---|---|---|
| Managed object | Encryption keys | Secret values | SSL/TLS certificates |
| Typical need | Encrypt S3, EBS, or RDS data | Rotate database passwords | Enable HTTPS on ALB or CloudFront |
| Protection stage | Data at rest | Secret lifecycle | Data in transit |
| Common integrations | S3, EBS, RDS, DynamoDB | RDS, Lambda, IAM roles | ALB, CloudFront, API Gateway |
Scenario shortcut
Choose KMS for encryption keys, Secrets Manager for password or token rotation, and ACM for HTTPS certificates.