> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dqlabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Overview
> What the AWS Secret Manager integration does and how Prizm retrieves connector credentials at runtime.
## What is the AWS Secret Manager integration?
The AWS Secret Manager integration allows Prizm to retrieve data source credentials — such as database passwords, API keys, and connection strings — directly from AWS Secrets Manager rather than storing them in Prizm. When a connector needs to authenticate with a data source, Prizm fetches the current secret value at runtime, ensuring your credentials are managed in one place and rotated without any changes in Prizm.
### What this integration enables
| Capability | Description |
| ---------------------------- | ---------------------------------------------------------------------------------------------------------- |
| Runtime credential retrieval | Prizm fetches secrets from AWS Secrets Manager at connection time rather than storing credentials locally. |
| Automatic rotation support | When a secret is rotated in AWS, Prizm uses the new value automatically on the next connection. |
| IAM-based access control | Access to secrets is governed by AWS IAM policies, keeping credential permissions centralized in AWS. |
| Cross-region support | Retrieve secrets from any AWS region by specifying the region in the integration configuration. |
| Zero credential storage | Credentials are never persisted in Prizm's database. |
### Using AWS Secret Manager with Prizm
Once configured, the AWS Secret Manager integration is available as a credential source when setting up any Prizm connector that requires credentials. Instead of pasting a password directly into a connector configuration, you reference the secret's name and Prizm retrieves the value at connection time.
When configuring a data source connector in Prizm, credential fields offer a **Use Vault** option. To pull a credential from AWS Secrets Manager:
1. Open the connector configuration for your data source (e.g., Snowflake, Databricks).
2. Locate a credential field such as **Password** or **Private Key**.
3. Enable the **Use Vault** toggle on that field.
4. Select the **AWS Secret Manager** integration from the vault dropdown.
5. Enter the **Secret Name** as it appears in AWS Secrets Manager (e.g., `prizm/snowflake-prod/password`).
6. Save the connector. Prizm retrieves the secret value each time it opens a connection to the data source.
### How Prizm retrieves secrets
When a connector opens a connection, Prizm calls the AWS Secrets Manager `GetSecretValue` API using the IAM credentials configured in the integration. The secret value is used in memory for the duration of the connection and is never written to Prizm's storage. If the secret has been rotated in AWS since the last connection, Prizm automatically uses the new value.
### Supported secret formats
Prizm can read secrets stored as:
* **Plaintext** — the secret value is used directly as the credential (e.g., a password stored as a plain string)
* **JSON key-value** — Prizm reads a specific key from a JSON secret (e.g., `{"password": "abc123", "username": "prizmuser"}`)
When referencing a JSON secret, enter the secret name followed by the key path (e.g., `prizm/snowflake-prod:password`).
Organize your Prizm-related secrets under a common path prefix in AWS Secrets Manager (e.g., `prizm/` or `data-platform/prizm/`). This makes the IAM policy simpler — a single resource ARN with a wildcard covers all Prizm secrets — and makes it easy to audit which secrets Prizm is authorized to access.
Connect AWS Secret Manager to Prizm — step-by-step configuration guide.