# QUE-266 · D4 — Secret store: AWS Secrets Manager vs SSM Parameter Store

Both hold the `ANTHROPIC_API_KEY` and let ECS inject it as an env var. They
differ on features and cost.

## What does not differ

ECS injects from either one identically. In the task definition you reference
either a Secrets Manager ARN or a Parameter Store ARN in the `secrets` block,
and the container sees an env var. The container code is the same either way.
The only wiring difference is whether the execution role gets
`secretsmanager:GetSecretValue` or `ssm:GetParameters`, plus `kms:Decrypt`.

## Comparison

| Dimension | Secrets Manager | SSM Parameter Store |
| --- | --- | --- |
| Cost | $0.40 per secret per month, plus $0.05 per 10,000 API calls | Standard SecureString is free. Advanced tier is $0.05 per parameter per month, which we do not need |
| Encryption | KMS, on by default | KMS via SecureString. The AWS-managed key has no monthly charge |
| Automatic rotation | Built in, with a rotation Lambda | None. You would script it |
| Max value size | 64 KB | 4 KB standard, 8 KB advanced |
| Cross-region replication, resource policies | Yes, richer | Limited |
| ECS task-definition integration | Native | Native |
| CloudTrail audit | Yes | Yes |

## Cost bottom line at our scale

Secrets Manager is about $0.40 per secret per month, so roughly $5 a year for
one key. Parameter Store SecureString on the standard tier is effectively free,
with only negligible KMS decrypt calls. Neither is a large number, but one is
free and the other is not.

## The deciding factor: rotation, which we do not need

The `ANTHROPIC_API_KEY` is a static third-party credential. Secrets Manager
earns its fee mainly through automatic rotation and its richer replication and
policy features. None of those apply to a single static key. So Parameter Store
SecureString gives you the same KMS encryption, the same ECS injection, and the
same audit trail, for free.

## Recommendation

**SSM Parameter Store SecureString.** Move to Secrets Manager only if you later
want managed rotation.