arosplatforms™AI consultancy
ar
← All articles

Vault vs AWS Secrets Manager: Which Should You Choose?

Vault vs AWS Secrets Manager: Which Should You Choose?

Hand-drawn security tools frame the title

Choose AWS Secrets Manager if your workloads run mostly on AWS and you want rotation and access control with almost no infrastructure to run. Choose HashiCorp Vault if you span several clouds or on-premises systems, or you need dynamic credentials, PKI and encryption as a service, and you have a team that can operate it. Most of the decision comes down to one question: do you want to consume a service or run a system?

This guide compares the two on architecture, rotation, auditing, cost and day-to-day operations. It also covers Secrets Manager versus Parameter Store, how CyberArk fits in, and the main Vault alternatives.

Arosplatforms
Build AI systems with secure foundations
Arosplatforms embeds AI systems within client operations, with solutions tailored to industry challenges and designed for team ownership.

TL;DR

  • Secrets Manager is a regional, fully managed AWS service. It is the pragmatic default when nearly everything lives in one AWS estate.
  • Vault is a platform you operate (or buy as a hosted service). It earns its overhead with dynamic secrets, PKI, multi-cloud reach and fine-grained policies.
  • Cost is not “free vs paid.” Secrets Manager bills per secret and per API call. Vault’s cost is mostly engineering time and infrastructure.
  • Parameter Store suits plain configuration. Use Secrets Manager for credentials that need managed rotation.
  • CyberArk is mainly privileged access management for people. It is a different category from both tools, though its Conjur product reaches into machine secrets.

Table of Contents

The short comparison

Criterion AWS Secrets Manager HashiCorp Vault
Delivery model Managed AWS service Self-hosted platform or hosted offering
Best environment AWS-native workloads Multi-cloud, hybrid, on-premises
Access control IAM policies Identity-based policies with fine granularity
Rotation Scheduled, with built-in Lambda rotation for some AWS databases Dynamic, short-lived credentials on demand
Auditing AWS CloudTrail Dedicated audit devices logging each request
Extras Replication across regions PKI, encryption as a service, many secrets engines
Pricing unit Per secret per month plus API calls Infrastructure and operations (or a vendor’s plan)
Operational load Low Higher

The rest of the article explains each row.

Architecture: a service you consume vs a system you run

AWS describes Secrets Manager as a way to centrally store and manage credentials, API keys and other secrets, and to rotate them automatically on demand or on a schedule. There are no servers to patch, no storage backend to size and no unsealing ceremony. Access flows through IAM, which your team already uses.

Vault is a different animal. HashiCorp positions it as an identity-based platform that manages access to secrets and other sensitive data, including certificates and keys, for humans, machines and AI agents. In practice that means you decide how to deploy it, how to make it highly available, how to back it up, how to unseal it and how to upgrade it. That work is the price of the flexibility.

A useful rule from the research: for organizations living inside one cloud, that provider’s native manager is usually the pragmatic choice, with lock-in and weaker multi-cloud support as the trade-offs.

Where multi-cloud changes the answer

Secrets Manager is AWS-only, and it is regional. Vault is designed for multi-cloud and hybrid environments. If your applications run on AWS, Azure and a few racks in a colocation facility, a single Vault control plane gives you one policy model and one audit trail. Running three native managers gives you three of each.

What each tool can actually do

Is Vault a secrets manager? Yes, but it is broader than that. The research describes it as handling static secret storage, dynamic secret generation, PKI and certificate lifecycle management, and encryption as a service. Secrets Manager focuses on storing and rotating credentials, and it does that job with little ceremony.

If your list of needs is “keep database passwords and API keys out of code and rotate them,” both tools cover it. If your list also includes issuing short-lived certificates or encrypting application data without handling keys, Vault is the one with those engines built in.

Rotation and dynamic credentials

This is the most important technical difference.

Secrets Manager rotates. A secret exists, and the service changes its value on a schedule. It supports automatic rotation through built-in Lambda functions for RDS, Redshift and DocumentDB credentials. For other secret types you write your own rotation function.

Vault generates. Its dynamic secrets create on-demand, short-lived credentials for databases, cloud providers and other systems. Each requester gets its own credential that expires, so a leaked value has a short useful life and every credential traces back to one caller.

Scheduled rotation compared with expiring credentials

Rotation shrinks the window in which a stolen secret works. Dynamic credentials make that window very small and make attribution cleaner. The cost is that your applications and your Vault deployment must handle leases and renewals correctly.

Security, access control and auditing

Both tools encrypt secrets and both can meet serious compliance needs. The differences are in granularity and where the evidence lives.

If your auditors already read CloudTrail, Secrets Manager adds almost no new evidence process. If you need one trail across clouds, Vault’s audit devices can feed a single log pipeline. For teams building AI systems, the same discipline applies to the data layer: our note on vector database security fixes covers how credentials and access tie into retrieval systems.

What each option costs in the US

The popular line is that Vault is free and Secrets Manager is not. That is true of Vault’s license in its community form, but it ignores who runs it.

Secrets Manager charges $0.40 per secret per month, plus $0.05 per 10,000 API calls. Pricing is flat with no volume discounts, and each multi-region replica counts as a separate secret.

A worked example using those two rates:

Scenario Secrets API calls per month Monthly cost
Small team 50 1,000,000 $20.00 + $5.00 = $25.00
Mid-sized platform 500 10,000,000 $200.00 + $50.00 = $250.00
Large estate with one replica region 2,000 (1,000 primary + 1,000 replicas) 50,000,000 $800.00 + $250.00 = $1,050.00

Those figures exclude any optional customer-managed KMS key charges.

Vault has no per-secret fee when you run it yourself, but you pay for compute, storage, backups, monitoring and the engineer-hours to keep it healthy and upgraded. A high-availability cluster in production is not a side project. Hosted Vault offerings replace some of that labor with a vendor bill, so request current pricing from HashiCorp rather than relying on a number in an article.

The break-even point is usually about people, not dollars. At a few hundred secrets, $250 a month is cheaper than a fraction of an engineer. At tens of thousands of secrets across several clouds, Vault’s operational cost can win.

What each option costs in the US

Secrets Manager vs Parameter Store

This is the other question that arrives with this topic, and it is a cheaper decision than Vault vs Secrets Manager.

AWS Systems Manager Parameter Store provides secure, hierarchical storage for configuration data such as environment variables or endpoint URLs, and for secrets, so applications do not hardcode values. AWS’s own guidance is to use Parameter Store for non-sensitive configuration and Secrets Manager for sensitive credentials that need managed rotation. Standard parameters are free, while Secrets Manager charges $0.40 per secret per month.

A simple split that works for many teams:

  1. Feature flags, endpoint URLs, non-sensitive settings: Parameter Store.
  2. Database passwords and third-party API keys that you want rotated: Secrets Manager.
  3. Short-lived credentials, certificates or cross-cloud secrets: Vault.

Vault vs CyberArk

These tools overlap less than the search suggests. CyberArk is a leader in privileged access management, built around privileged human access and session recording. Its Conjur product is a secrets management platform for machine identities and DevOps workloads, with APIs to authenticate hosts and users, load policies, and store and retrieve versioned secrets.

A practical way to choose:

  • If your main risk is administrators and vendors using privileged accounts, start with a PAM tool such as CyberArk.
  • If your main risk is applications and pipelines holding long-lived credentials, start with a secrets manager such as Vault or Secrets Manager.
  • Large enterprises often need both, because they solve different problems.

Vault alternatives worth knowing

If Vault feels heavy but Secrets Manager is too narrow, the research names several options:

  • OpenBao: a community fork of Vault under the MPL-2.0 license, for teams that want the Vault model and open governance.
  • Infisical and Doppler: developer-friendly tools focused on syncing secrets into apps and pipelines.
  • Azure Key Vault and Google Secret Manager: the native choices on those clouds. Azure Key Vault safeguards keys, secrets and certificates for cloud apps, offers Standard and Premium tiers, and prices secret and key operations by transaction volume. These sources are summarized in a comparison of eight Vault alternatives.

If you are also weighing which cloud to build on, our comparison of AWS vs Google Cloud for AI walks through that decision.

How to choose

Work through these questions in order:

  1. Where do your workloads run? All on AWS points to Secrets Manager. Several clouds or on-premises points to Vault.
  2. Do you need dynamic credentials, PKI or encryption as a service? If yes, Vault.
  3. Who will operate it? If nobody owns the platform, a managed service is safer than a neglected Vault cluster.
  4. How many secrets do you have, and how fast will that grow? Run the per-secret math above against your real counts.
  5. What will auditors ask for? If CloudTrail and Security Hub already satisfy them, you have less to build.

A common path is to start on Secrets Manager and Parameter Store, then add Vault when a second cloud or a need for dynamic credentials appears. Keep application code behind a thin secrets interface so that migration is a configuration change rather than a rewrite.

Our perspective

Secrets tooling looks like a security choice, but for the teams we work with it is really an operating-model choice. The question we ask first is who will own the system in two years, not which product has the longer feature list.

When we design AI systems for clients, credentials multiply fast: model API keys, database connections, agent tool tokens and integration accounts. We treat that as a governance and security design problem from day one, and we build so that your team owns and can run what we deliver, with no vendor lock-in.

For AWS-centered clients, that often means using the native services well and keeping the design portable. For clients with hybrid estates, it means planning the secrets layer alongside the platform itself, with auditing and access policy defined before production.

arosplatforms team

Getting the secrets layer right in an AI project

If you are deploying AI agents or knowledge systems, the secrets decision belongs inside the platform design, not after it. We work on platform deployment in your own cloud, with security and compliance automation planned from the start. To talk through a project, see our AI services.

FAQ

Is Vault better than AWS Secrets Manager?

Neither is better in general. Vault is stronger for multi-cloud environments and for dynamic secrets and PKI. Secrets Manager is stronger when you want a managed AWS service with IAM access and minimal operations.

Is Vault a secrets manager?

Yes. Vault stores static secrets, but it also generates dynamic credentials, manages certificates and offers encryption as a service. That breadth is why it is often described as a platform rather than only a secrets store.

Can I use Vault and Secrets Manager together?

Yes, and many teams do. A common pattern is Secrets Manager for AWS-native workloads and Vault for cross-cloud or dynamic-credential needs. Keep a single policy owner so the two do not drift apart.

When should I use Parameter Store instead of Secrets Manager?

Use Parameter Store for non-sensitive configuration, since standard parameters are free. Use Secrets Manager when you need managed rotation for credentials such as database passwords.

Does AWS have a secrets manager?

Yes. AWS Secrets Manager stores, rotates and retrieves database credentials, API keys and other secrets. It bills at $0.40 per secret per month plus API call charges.

Sources

Related: custom AI development.