Think - with -Tech: AWS Secrets Manager & Multi-Region Secrets

Thursday, October 23, 2025

AWS Secrets Manager & Multi-Region Secrets | Overview & Hands-On.

AWS Secrets Manager & Multi-Region Secrets - Overview & Hands-On.

Focus:

Intro,
Key Features of Multi-Region Replication,
Managing Replicas,
Implementation & Best Practices,
The concept (deep dive),
Core Concept of A multi-Region secret,
Architecture,
Table for Synchronization Model,
API call & CLI Samples Commands,
Multi-Region Rotation Design,
Use Cases & Description,
KMS Integration,
Sample policy for Multi-Region Secrets,
Sample CloudFormation stack for Multi-Region Setup,
Table for Limitations & Gotchas,
Best Practices (deep dive),
Sample Disaster Recovery (DR) Flow,
Project: Hands-on

Intro:

AWS Secrets Manager allows twtech to replicate secrets across multiple AWS Regions to support disaster recovery and global application availability.
This feature ensures that a primary secret and its regional replicas remain synchronized, facilitating easier management for multi-region workloads.

Key Features of Multi-Region Replication

Automatic Synchronization: When twtech update or rotate a primary secret, AWS Secrets Manager automatically propagates those changes to all associated replica secrets.
Shared Secret Names: Replicas share the same name as the primary secret, allowing applications in different regions to use the same code to retrieve credentials locally.
Disaster Recovery: Replica secrets are independent resources with their own ARNs.

If the primary region experiences an outage, applications can still access their local regional replicas.

Regional Flexibility: twtech can replicate secrets to any enabled AWS Region, including specialized regions like AWS GovCloud (US) or China (though replication is restricted to within those specific specialized partitions).

Managing Replicas

Promotion: twtech can promote a replica secret to a standalone secret if it needs to manage it independently from the original primary secret.
Deletion: To delete a secret with replicas, twtech must first remove all replicas before it can delete the primary secret.
Permissions: Replication can be controlled or restricted using IAM policies, specifically by managing the secretsmanager:ReplicateSecretToRegions permission.

Implementation & Best Practices

How to Enable: twtech can configure replication through the AWS Management Console, AWS CLI, or AWS CloudFormation.
Encryption: For cross-region or cross-account access.

Encryption is recommended for customer managed key from the AWS Key Management Service (KMS) rather than the default AWS managed key.

Cost: Storing a secret costs $0.40 per secret per month, and each regional replica is billed as an additional secret.

The concept (deep dive)

Multi-Region Secrets in AWS Secrets Manager (released in 2022) let twtech replicate secrets across AWS Regions automatically
CRR (cross regional replication) keeps Secrets:

secure,
consistent,
highly available for global applications.

· NB:

Instead of manually replicating secrets or building Lambda sync mechanisms, Secrets Manager handles this natively.

Core Concept of A multi-Region secret:

Primary secret – the authoritative version (source of truth).
Replica secrets – synchronized copies in other Regions.

All metadata, secret values, versions, and rotation configuration are replicated automatically by AWS Secrets Manager.
twtech creates or promotes one primary, then replicate it to one or more Regions.

Architecture

Primary Region

Secret is created normally (includes encryption with a regional KMS CMK).
Designated as the primary.

Replication Process

twtech calls replicate-secret-to-regions (AWS CLI) or configure via console/CloudFormation.
Secrets Manager:

Creates replicas in target Regions.
Creates new KMS keys or uses existing ones in each Region.
Synchronizes secret data and metadata.

Replication occurs
Replication occurs asynchronously, but typically completes in seconds.

Replica Regions

Each replica:

Is read-only.
Maintains its own ARN and KMS key.
Can be promoted to primary if needed (disaster recovery scenario).

Table for Synchronization Model

Component	Behavior	Notes
Secret value	Automatically synchronized whenever primary updates	Encryption happens per-region via each region’s CMK
Metadata (tags, description)	Synchronized	Not all metadata (like replication status) is mirrored
Rotation configuration	Synchronized	Rotation runs only in primary region
Versions	Propagated	Each region maintains its version chain
Deletion	Cascade deletion or isolated deletion	Controlled via delete replication setting

API call & CLI Samples Commands

# Create Primary Secret

aws secretsmanager create-secret --name twtechGlobalDBSecret --secret-string '{"username":"twtechadmin","password":"twtechSuperSecret@123"}' --kms-key-id arn:aws:kms:us-east-2:accountID:key/twtechkmskey-abcd1234

# Replicate to Other Regions

aws secretsmanager replicate-secret-to-regions --secret-id arn:aws:secretsmanager:us-east-2:accountID:secret:twtechGlobalDBSecret-abc123 --add-replica-regions Region=us-west-1,KmsKeyId=arn:aws:kms:us-west-1:accoundID:key/twtechkmskey-wxyz9876

# View Replication Status

aws secretsmanager describe-secret --secret-id twtechGlobalDBSecret

# Promote a Replica to Primary (Useful in DR/failover scenario)

aws secretsmanager promote-replica-secret-to-primary --secret-id arn:aws:secretsmanager:us-west-1:accountID:secret:twtechGlobalDBSecret-xyz456

Multi-Region Rotation Design

Rotation only runs in the primary region.
When the secret rotates:

New value is written in the primary.
Replicas are updated automatically with the new value.

This avoids duplication of rotation logic across Regions.
This avoids duplication of rotation logic across Regions.

If the primary Region is unavailable, twtech can:

Promote a replica to primary.
Re-enable rotation there.

Use Cases & Description

Use Case	Description
Global high availability apps	Multi-Region applications (e.g., Route 53 health-checked failover) can access secrets locally for lower latency.
DR/failover setups	If primary region fails, replicas provide continuity — simply promote one to primary.
Latency-sensitive services	Microservices deployed across multiple AWS regions retrieve secrets locally, reducing inter-region calls.
Compliance-driven regional data access	Secrets can be encrypted with regional KMS keys to satisfy data residency requirements.

KMS Integration

Each Region must have a unique KMS key (customer-managed or AWS-managed).

Best practice:

Use customer-managed CMKs with identical key policies.
Enable automatic key rotation for KMS.
Allow cross-region and Secrets Manager service principal permissions, e.g.:

Sample policy for Multi-Region Secrets

# json

{
"Sid": "twtechAllowSecretsManagerUse",
"Effect": "Allow",
"Principal": { "Service": "secretsmanager.amazonaws.com" },
"Action": [
    "kms:Encrypt",
    "kms:Decrypt",
    "kms:GenerateDataKey*"
],
"Resource": "*"
}

Sample CloudFormation stack for Multi-Region Setup

# CloudFormation-Sample-stack-for-Multi-Region-Setup.yaml

Resources:

PrimarySecret:

Type: AWS::SecretsManager::Secret

Properties:

Name: twtechGlobalSecret

Description: twtech Global database credentials

KmsKeyId: !Ref PrimaryKMSKey

SecretString: '{"username":"twtechadmin","password":"twtechSuperSecret@123"}'

PrimaryKMSKey:

Type: AWS::KMS::Key

Properties:

Description: twtech KMS key for primary secret

EnableKeyRotation: true

ReplicaSecretWest:

Type: AWS::SecretsManager::ReplicaRegion

Properties:

Region: us-west-1

KmsKeyId: arn:aws:kms:us-west-1:accountID:key/twtechkmskey-wxyz9876

NB:

CloudFormation supports replica configuration within the primary secret’s resource definition (ReplicaRegions property).

Table for Limitations & Gotchas

Limitation	Explanation
Write access only in primary	Replicas are read-only until promoted.
Rotation limited to primary	Automatic rotation doesn’t run in replicas.
Replication lag	Usually seconds, but asynchronous. Not for millisecond RPO.
Cross-account not supported directly	Multi-region only (not multi-account). Use Resource Policies + KMS grants for multi-account access.
Pricing	Each replica incurs the same monthly fee as a normal secret.

Best Practices (deep dive)

Use multi-region replication for critical global workloads.
Combine with Route 53 failover or AWS Global Accelerator for DR.
Combine with Route 53 failover or AWS Global Accelerator for DR.
Combine with Route 53 failover or AWS Global Accelerator for DR.
Always encrypt with CMKs (not AWS-managed keys) for compliance and control.
Monitor replication using CloudWatch metrics: