# Secrets Manager > zop.dev writes generated credentials to Secrets Manager from every module that mints them (4 RDS entries per instance, Kafka SCRAM, observability admin, S3 user), and exposes secrets as a direct resource type. Each secret bills about 0.40 USD per month, and deletion is deferred by a 7-to-30-day recovery window. Source: https://zop.dev/integrations/provision/aws/secrets-manager Updated: 2026-08-19 --- AWS Secrets Manager keeps database passwords, API keys, and service credentials out of code. zop.dev both writes generated credentials here during provisioning and exposes secrets as a directly manageable resource. ## Secrets written directly and by other modules Secrets Manager secrets created directly via the provisioner API, plus the credential entries that other modules generate automatically (RDS master/user/editor/read-only, Kafka SCRAM, observability admin and S3 user). ## secret_string and the RDS db-secret name ```text secret_string payload for direct creation; RDS provisioning auto-generates a password and stores it as -db-secret. ``` ## Mounted into pods by the secrets-store CSI driver Namespaces mount secrets into pods through the AWS secrets-store CSI driver via SecretProviderClass. ## Entries arrive from two directions Some secrets are created deliberately through the provisioner API with a `secret_string` payload. The rest arrive as side effects: RDS provisioning writes master, app user, editor, and read-only entries (the password lands as `-db-secret`), MSK writes SCRAM credentials, the observability stack writes its admin and S3 user. An inventory of Secrets Manager is therefore an inventory of what the platform has provisioned. Most entries were never typed by a human, which is the point: credentials nobody has seen are credentials nobody can leak from a terminal history. ## Deletion takes weeks by design Deleting a secret schedules it for deletion after a recovery window of 7 to 30 days (30 by default) rather than removing it. During the window the secret is recoverable, but its name is unavailable for reuse, which surprises anyone tearing down and recreating an environment under the same name. The window exists because a secret still referenced by a running system fails slowly and confusingly; forcing immediate deletion is possible but discards exactly the safety net that failure mode needs. ## Forty cents, multiplied Pricing is about 0.40 USD per secret per month plus per-10,000 API calls. That is nothing until it is multiplied. Four RDS entries per instance, times instances, times environments, plus attachment-minted credentials adds up to a steady line item made of entries nobody remembers. The cost is small; the hygiene signal is not. A Secrets Manager bill that only ever grows means retired environments are not cleaning up after themselves. ## Pods consume through the CSI driver Namespaces mount secrets into pods via SecretProviderClass and the AWS secrets-store CSI driver: the pod sees files, the cluster stores no copy of the value in its own etcd, and a rotated secret reaches workloads on remount instead of requiring a manifest edit.