Your data scientists finally built a model that predicts downtime hours before it happens. Nice. But now they need credentials for an S3 bucket, three databases, and a private API. One Slack message later, someone just pasted a secret into chat. You sigh. Then you remember AWS Secrets Manager and Domino Data Lab can stop this circus cold.
AWS Secrets Manager stores and rotates credentials so teams never share passwords by hand. Domino Data Lab orchestrates reproducible data science environments where models and experiments run under controlled permissions. Together they let you automate secure access to everything from Redshift to internal APIs, without ever exposing secrets to your notebook cells.
Picture it like this: AWS Secrets Manager holds the keys, IAM defines who can borrow them, and Domino acts as the valet—fetching those keys only for authorized runs. Instead of embedding credentials in your environment variables forever, Domino can request short-lived tokens through IAM roles or the AWS SDK at runtime. That means if someone clones your project, the secrets stay behind the vault door.
To integrate the two, link Domino’s workspace environment variables to AWS Secrets Manager references. Use IAM roles mapped to your Domino users or compute environments. When a job starts, it reads its secrets directly from AWS, using the permissions of the running identity. No local copies, no manual rotation. Just clean, auditable access.
If you manage multiple user tiers, map role-based access controls (RBAC) from Domino groups to IAM policies. Data scientists get read access to analytics data. Platform admins get update rights for secret definitions. Then set automatic rotation intervals inside Secrets Manager. You sleep better knowing every credential refreshes before an audit forces you to.