Skip to main content

​
What is the AWS Secret Manager integration?

The AWS Secret Manager integration allows Prizm to retrieve data source credentials — such as database passwords, API keys, and connection strings — directly from AWS Secrets Manager rather than storing them in Prizm. When a connector needs to authenticate with a data source, Prizm fetches the current secret value at runtime, ensuring your credentials are managed in one place and rotated without any changes in Prizm.

​
What this integration enables

​
Using AWS Secret Manager with Prizm

Once configured, the AWS Secret Manager integration is available as a credential source when setting up any Prizm connector that requires credentials. Instead of pasting a password directly into a connector configuration, you reference the secret’s name and Prizm retrieves the value at connection time. When configuring a data source connector in Prizm, credential fields offer a Use Vault option. To pull a credential from AWS Secrets Manager:
  1. Open the connector configuration for your data source (e.g., Snowflake, Databricks).
  2. Locate a credential field such as Password or Private Key.
  3. Enable the Use Vault toggle on that field.
  4. Select the AWS Secret Manager integration from the vault dropdown.
  5. Enter the Secret Name as it appears in AWS Secrets Manager (e.g., prizm/snowflake-prod/password).
  6. Save the connector. Prizm retrieves the secret value each time it opens a connection to the data source.
Connector configuration panel showing the Use Vault toggle enabled and AWS Secret Manager selected with a secret name entered

​
How Prizm retrieves secrets

When a connector opens a connection, Prizm calls the AWS Secrets Manager GetSecretValue API using the IAM credentials configured in the integration. The secret value is used in memory for the duration of the connection and is never written to Prizm’s storage. If the secret has been rotated in AWS since the last connection, Prizm automatically uses the new value.

​
Supported secret formats

Prizm can read secrets stored as:
  • Plaintext — the secret value is used directly as the credential (e.g., a password stored as a plain string)
  • JSON key-value — Prizm reads a specific key from a JSON secret (e.g., {"password": "abc123", "username": "prizmuser"})
When referencing a JSON secret, enter the secret name followed by the key path (e.g., prizm/snowflake-prod:password).
Organize your Prizm-related secrets under a common path prefix in AWS Secrets Manager (e.g., prizm/ or data-platform/prizm/). This makes the IAM policy simpler — a single resource ARN with a wildcard covers all Prizm secrets — and makes it easy to audit which secrets Prizm is authorized to access.

Setup

Connect AWS Secret Manager to Prizm — step-by-step configuration guide.