Many engineers begin secrets management by thinking about encryption.
The larger problem is access.
A database password is different from a configuration value because it grants access to another system. Encrypting that password protects storage, but encryption alone does not determine who can retrieve it.
This lesson walks through the security layers involved in AWS secrets management using Parameter Store, KMS, IAM, and Terraform. It also covers a risk that many beginners miss: Terraform state files can become secret repositories when credentials are managed directly through infrastructure code.
Understanding where secrets are stored, who can retrieve them, and how they move through a deployment is the foundation of building secure infrastructure.