[acdha]

KMS manages encryption keys. A secrets manager gives you an API for storing and referencing arbitrary named secret values with audit logs, etc. for them, which are encrypted using KMS.

For example, this might be something like “store a secret ‘my app remote API key’ encrypted with a regularly rotated key and allow ‘my app container’ to retrieve the value”.

[tyingq]

"Named secrets" being things like the plaintext password for a database, API tokens, etc.

[acdha]

Good point - I edited to clarify that a little more