AWS finally lets you stash external secrets without rolling your own vault

Secrets Manager now supports managed external secrets — you can point it at GitLab or Paddle and it handles the rotation for you. No more spinning up a sidecar just to pull tokens from another service.

The old way was brittle. You wrote scripts that hit an API, stored the result in SSM or Parameter Store, and scheduled a cron to refresh it. One permission mistake and your whole pipeline leaked. AWS is closing that gap by letting the service manage the handshake. The public preview is in now.

Why this matters for us: a lot of Brown-run shops are stitching together tools with curl and cron jobs — this cuts the friction so you can keep the pieces without the maintenance tax.