AWS Secrets Manager now supports cross-account replication, enabling you to maintain a synchronized copy of a primary secret in a secondary AWS account for cross-account access, backup, and disaster recovery. Cross-account replication extends the existing multi-Region replication capability across account boundaries.
With cross-account replication, platform or security teams can own and rotate a secret centrally, and each consuming account gets a local, always-current copy without any shared KMS keys or cross-account secret policies. The replica secret is a full, independent resource, encrypted with a customer managed KMS key owned by the replica account. Secrets Manager updates it automatically whenever the primary secret’s value changes, including rotations.
You can keep a live copy of critical secrets in a dedicated recovery or failover account, isolated from ransomware or a compromised primary account. If needed, the replica can be promoted to a standalone secret.
Cross-account replication is available in all AWS Regions where Secrets Manager is available. For a list of regions where Secrets Manager is available, see the AWS Region table.
To learn more, see Replicate secrets across AWS accounts in the Secrets Manager User Guide and the AssociateCrossAccountReplica API reference. For pricing details, see AWS Secrets Manager pricing.
Categories: marketing:marchitecture/security-identity-and-compliance,general:use-case/disaster-recovery,general:products/aws-secrets-manager
Source: Amazon Web Services
