In this integration model, AWS Secrets Manager functions as an External Vault — a cloud-native credential store that receives and optionally originates External Secrets synchronized from Secret Server. Secret Server remains the authoritative System of Record for all privileged access governance: policy enforcement, rotation scheduling, dependency tracking, check-out workflows, and compliance audit history.

The AWS Secrets Manager Sync Connector (ASM Sync) bridges these two systems. It handles field-level translation between Secret Server's structured template model and AWS Secrets Manager's JSON key-value format, maintains sync version state using secret tags, enforces conflict resolution policies, and produces correlated audit events across both platforms.

All prerequisites must be confirmed across both platforms before activating the External Vault connector. Unvalidated prerequisites account for the majority of failed initial External Secret syncs.

External Vault connector setup follows three phases: IAM identity and trust relationship creation in AWS, permissions policy attachment scoped to External Secret resources, then registration and activation inside Secret Server's External Vault Connectors panel.

Phase 1 — IAM Role & Trust Policy

Create the IAM role that the connector will assume via STS. The trust policy must include a mandatory ExternalId condition — this prevents confused deputy attacks from other AWS accounts.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {
      "AWS": "arn:aws:iam::ACCOUNT_ID:role/SS-DistributedEngine-Profile"
    },
    "Action": "sts:AssumeRole",
    "Condition": {
      "StringEquals": {
        "sts:ExternalId": "SS_EXT_VAULT_TOKEN_SET_IN_UI"  // generated in SS connector UI
      }
    }
  }]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ExternalSecretsCRUD",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetSecretValue",
        "secretsmanager:PutSecretValue",
        "secretsmanager:CreateSecret",
        "secretsmanager:UpdateSecret",
        "secretsmanager:DescribeSecret",
        "secretsmanager:ListSecrets",
        "secretsmanager:TagResource",
        "secretsmanager:RestoreSecret"        // for conflict recovery
      ],
      "Resource": "arn:aws:secretsmanager:REGION:ACCOUNT:secret:ss-ext/*"
    },
    {
      "Sid": "EnvelopeEncryption",
      "Effect": "Allow",
      "Action": [
        "kms:GenerateDataKey",
        "kms:Decrypt",
        "kms:DescribeKey"
      ],
      "Resource": "arn:aws:kms:REGION:ACCOUNT:key/CMK_KEY_ID"
    }
  ]
}

Phase 2 — External Vault Registration in Secret Server

Secret Server organizes credentials in typed Secret Templates with named fields and field-level metadata. AWS Secrets Manager stores External Secrets as flat JSON key-value documents (or plaintext strings). The External Vault Template Mapper serializes SS template fields into structured JSON for ASM writes and deserializes them on pull operations — handling type coercion, field aliasing, and sensitive field classification.

Built-In External Secret Template Mappings

Custom External Vault Template Map Definition

# External Vault Template Map registered under Admin → External Vault → Template Maps
external_vault_template_maps:
  - ss_template: "Oracle Service Account"
    external_vault_connector: "asm-prod-us-east-1"
    external_secret_prefix: "oracle"       # → ss-ext/oracle/{ss-id}
    sync_direction: bidirectional
    secret_string_format: json             # json | plaintext
    kms_key_override: "arn:aws:kms:us-east-1:123:key/oracle-cmk"
    field_map:
      - ss_field: "Username"
        asm_key: "username"
        sensitive: false
      - ss_field: "Password"
        asm_key: "password"
        sensitive: true        # SS wins on conflict
      - ss_field: "Server"
        asm_key: "host"
        sensitive: false       # ASM wins on conflict
      - ss_field: "Port"
        asm_key: "port"
        type_coerce: string    # ASM stores all values as strings
      - ss_field: "Database"
        asm_key: "dbname"
        sensitive: false
    external_secret_tags:
      ss-managed: "true"               # mandatory pull filter tag
      ss-template: "oracle-svc-account"
      environment: "production"
      data-classification: "confidential"

The External Vault sync engine applies a deterministic, version-vector–based rule set governing when, what, and in which direction External Secrets are synchronized. Understanding these rules is essential for predicting system behavior under concurrent modification or network failure scenarios.

# AWS Secrets Manager tags on every External Secret managed by SS
ss-managed:          "true"                     # pull filter gate
ss-secret-id:        "7841"                     # SS internal ID
ss-template:         "oracle-svc-account"
ss-folder-path:      "Production/Databases/Oracle"
ss-sync-version:     "127"                      # SS version counter; conflict detection key
ss-last-synced:      "2026-04-02T16:44:00Z"
ss-connector-id:     "asm-prod-us-east-1"
ss-correlation-id:   "a3f9c2d1-sync"            # cross-platform audit correlation

# /etc/ss-engine/asm-ext-vault-throttle.ini

[aws_secrets_manager]
max_requests_per_second  = 50     # ASM default service quota (request/s per region)
burst_capacity           = 150    # token bucket burst size
retry_policy             = "exponential_jitter"
retry_max_attempts       = 5
retry_base_delay_ms      = 1000
retry_max_delay_ms       = 30000

[sync_batching]
external_secrets_per_batch = 20
batch_interval_ms          = 500
parallel_template_workers  = 4   # concurrent External Vault template map workers
list_secrets_page_size     = 100  # ASM ListSecrets max per page
delta_sync_enabled         = true

[kms]
data_key_cache_ttl_secs  = 300   # reuse envelope DEK per External Secret for 5 min
max_decrypt_per_second   = 5000  # KMS CryptographicOperations default quota

A sync conflict arises when an External Secret is modified in both Secret Server and AWS Secrets Manager between polling cycles. The connector detects conflicts by comparing the ASM secret's ss-sync-version tag value against Secret Server's current internal version counter before any write is committed. Click each scenario to expand the resolution strategy.

conflict_resolution:
  default_authority: secret_server
  merge_enabled: true
  sensitive_field_winner: secret_server       # password, private_key, token
  infra_field_winner: aws_secrets_manager     # host, port, dbname, url
  on_overlapping_sensitive: secret_server_wins
  on_unresolvable: quarantine_and_alert
  alert_target: "cloudwatch-alarm:ext-vault-conflict"

The External Vault integration's security model ensures that External Secret values never traverse the network unencrypted, access is governed by least-privilege identities on both platforms, and every sync operation generates tamper-evident, correlated audit records across both systems of record.

Shared Responsibility Matrix

┌──────────────────────────────────┬─────────────────────┬────────────────────────┐
│ Responsibility Domain            │ Secret Server        │ AWS Secrets Manager    │
├──────────────────────────────────┼──────────────────────┼────────────────────────┤
│ Credential lifecycle (RPC)       │ ✓ Owner              │ Governed replica       │
│ Access policy & check-out        │ ✓ Owner              │ IAM complement         │
│ Native AWS service delivery      │ Via External Secret  │ ✓ Owner                │
│ KMS envelope key custody         │ AES-256 at-rest SS  │ ✓ Owner (FIPS CMK)     │
│ Rotation scheduling (RPC)        │ ✓ Owner              │ Triggered by push      │
│ Conflict resolution authority    │ ✓ Configurable       │ Field-level override   │
│ PAM audit trail                  │ ✓ Owner              │ Correlated via tag     │
│ API audit trail (CloudTrail)     │ Correlated via ID    │ ✓ Owner                │
└──────────────────────────────────┴──────────────────────┴────────────────────────┘

Five questions covering core integration concepts. Complete all questions before the deployment checklist.

Complete every item before promoting the External Vault connector to production. Completion is tracked for this session.

AWS Infrastructure Hardening

• IAM trust policy has sts:ExternalId condition set and matches SS connector UI token
• IAM permissions policy scoped exclusively to ss-ext/* resource prefix
• CMK key policy restricts kms:Decrypt and kms:GenerateDataKey to the External Vault connector role only
• VPC Endpoint deployed for Secrets Manager; public ASM endpoint disabled via resource policy
• Secrets Manager resource policy on ss-ext/* denies all principals except External Vault connector role
• CloudTrail enabled with S3 object lock for immutable External Secret access audit logs
• EventBridge rule configured to deliver SecretVersionCreated events to connector webhook (near-RT pull)
• Service quota increase confirmed for Secrets Manager API requests/second if > 40 External Secrets

Secret Server Configuration

• External Vault connector connection test passes all three probe checks (STS, KMS, ASM list)
• External Vault Template Maps validated for all in-scope templates in non-production environment
• External Secret prefix naming convention documented and applied consistently
• Pull filter verified: ss-managed: true tag confirmed on test External Secrets post-push
• Conflict resolution policy set (SecretServerWins) and approved by security team
• Distributed Engine pool assigned to the External Vault connector with AWS network access confirmed

Operational Readiness

• Runbook authored for manual conflict resolution and External Vault quarantine queue management
• CloudWatch alarms configured: sync failures, conflict events, KMS quota throttling, STS token errors
• Consumer application teams briefed: max External Secret cache TTL ≤ 60 seconds
• Cross-platform audit correlation query validated (CloudTrail + SS audit log via ss-correlation-id)
• Rollback procedure documented: disable connector, restore prior ASM version, repoint consumers
• External Vault connector health dashboard published to Security Operations team