[jvanderhoof]

I believe KMS is primarily for storing encryption keys (to replace an HSM). AWS Secrets Manager looks like it's much easier to integrate into credential best practices, like periodic rotation.