AWS Secrets Manager is an AWS service that makes it easier for you to manage secrets like database credentials, passwords, third-party API keys, and even arbitrary text. By default, AWS Secrets Manager has a default encryption key that Secrets Manager creates on your behalf. But when you use your own Amazon KMS Customer Master Key (CMK) to protect the secret data managed by AWS Secrets Manager service, you get full control over who can use the encryption key to access your secrets. Amazon Key Management Service (KMS) allows you to easily create, rotate, disable and audit Customer Master Keys created for your Secrets Manager secrets.