AWS/Secrets Manager/Q/What terms does AWS Secrets Manager use for single-valued vs. multi-valued secrets, and what can each do that the other can't?

• What terms does AWS/Secrets Manager use for single-valued vs. multi-valued secrets, and what can each do that the other can't?

  • AI Answer

    • Answer/Official from Create an AWS Secrets Manager secret, CreateSecret API reference, and Pass Secrets Manager secrets through Amazon ECS environment variables:
    • Short answer: there is no distinct secret type for this at the API level — every secret is one opaque AWS/Secrets Manager/Secret. Answer/Official from CreateSecret API reference: "Either SecretString or SecretBinary must have a value, but not both." "Single vs. multi-valued" is codekiln's own shorthand, mapped onto two garden pages: AWS/Secrets Manager/Secret/SecretString (AWS's Plaintext tab — one raw string) is single-valued; AWS/Secrets Manager/Secret/KeyValue (AWS's Key/value pairs tab — the same field holding a JSON object) is multi-valued.
    • Create an AWS Secrets Manager secret: "In Key/value pairs, either enter your secret in JSON Key/value pairs, or choose the Plaintext tab and enter the secret in any format." Its examples: an API key → key/value pairs (ClientID, ClientSecret); an OAuth token, certificate, or private key → plaintext.
    • What only AWS/Secrets Manager/Secret/KeyValue (multi-valued) can do:
      • AWS's ready-made rotation Lambda templates. Direct citations and the full picture — including a third, Lambda-less "managed rotation" path that's gated by how a secret was created, not by its shape: AWS/Secrets Manager/Secret/Rotation. Core citation: CreateSecret API reference: "you must make sure the JSON you store in the SecretString matches the JSON structure of a database secret" for those templates to work. AWS/Secrets Manager/Secret/SecretString (single-valued/plaintext) can still be rotated, but only with a fully custom Lambda — there's no ready-made template for it.
      • Pulling one field without app-side parsing. Pass Secrets Manager secrets through Amazon ECS environment variables: "Specifies the name of the key in a key-value pair with the value that you want to set as the environment variable value. Only values in JSON format are supported." AWS/Secrets Manager/Secret/SecretString has no key to address this way. (fnox mirrors this client-side with its json_path option, per its provider docs, including dotted nested paths.)
      • Fewer resources for related values, at lower cost. AWS Secrets Manager pricing: worked example prices a secret "@ $0.40 / secret / month" — four related values as one AWS/Secrets Manager/Secret/KeyValue secret cost the same as one AWS/Secrets Manager/Secret/SecretString, versus 4x if split into four single-valued secrets.
    • What single-valued buys you that multi-valued doesn't: nothing capability-wise — it's a strict subset. Its only edge is simplicity for a value that's genuinely atomic (a bare API key, a cert, a private key), where there's no field to key on and no rotation Lambda will ever need named subfields.