Secrets management

Applications need passwords and API keys at runtime, and the wrong place for them is hardcoded in code or baked into an image where they leak. Secrets Manager stores and rotates them, Parameter Store offers a lighter option, and both hand secrets out only to IAM-authorized callers, encrypted and audited.