AWS Secrets Manager vs Phase

AWS Secrets Manager

IAM roles support access without long-lived credentials on AWS compute services. Each API call is billed, making caching relevant to frequent reads.

Phase

Service account tokens can be minted with an expiry over the API, every secret read is logged, and the CLI redacts values when it detects an AI agent. No OpenAPI document or pagination was found in the reviewed documentation, and the Free plan keeps audit logs for 24 hours.

AWS Secrets Manager

1. Give the agent's task or instance role secretsmanager:GetSecretValue on the specific secret ARN, not a wildcard
2. Cache the value for the run, or read through the Workload Credentials Provider on localhost; each GetSecretValue is billed and logged
3. In Claude Code or Codex, install the aws-core plugin from the Agent Toolkit for AWS and pass secrets as {{resolve:secretsmanager:...}} references through asm-exec so values stay out of context
4. Pass a ClientRequestToken on PutSecretValue so a retry can't create a second version, and don't write more than once every 10 minutes
5. Read VersionStage AWSPREVIOUS if a rotation lands mid-run and the new credential isn't live yet

Phase

1. Enable server-side encryption on the app before calling /v1/secrets. Without it the REST API cannot read or write that app's secrets
2. Send Authorization: Bearer ServiceAccount <token> for a service account and Bearer User <token> for a personal access token. The token type is part of the header
3. Stay under 120 requests a minute per account on Free and 240 on Pro, and wait the seconds in the retry-after header on a 429
4. Treat a 409 on POST /v1/secrets as the key already existing at that path, and use PUT to change it. Rotating secrets reject PUT and DELETE
5. Have a person run phase ai enable and choose masked values. The CLI blocks an agent from running phase ai enable or phase ai disable itself