HashiCorp Vault is powerful, but it requires you to deploy, operate, scale, and maintain the Vault servers yourself — including managing storage backends, high availability, upgrades, and the unseal process. For teams that want secrets management without the operational overhead of running Vault, cloud providers offer managed alternatives.
AWS Secrets Manager is AWS's fully managed secrets storage and rotation service. You pay per secret per month and per API call — AWS handles all the infrastructure.
Integration with the AWS Ecosystem
AWS Secrets Manager's greatest strength is how naturally it fits into existing AWS workflows. Access control uses standard IAM policies — the same system you already use to control access to S3 buckets, EC2 instances, and Lambda functions. There is no separate policy language to learn: granting a Lambda function read access to one specific secret is just an IAM statement allowing secretsmanager:GetSecretValue scoped to that secret's ARN.
AWS services like RDS, ECS, Lambda, and EKS have native integrations that can inject secrets directly into containers or reference them in task definitions without your application code making explicit API calls.
Automatic Rotation via Lambda
The hardest operational challenge in secrets management is not storage — it is rotation. Changing a database password requires updating the database server and updating every application that uses it, ideally simultaneously and without downtime.
AWS Secrets Manager automates this using Lambda functions. You configure a rotation schedule (e.g., every 30 days), and AWS provides pre-built Lambda blueprints for common services (RDS MySQL, RDS PostgreSQL, Redshift, DocumentDB). The rotation Lambda follows a four-step process:
- createSecret: Generate a new credential and store it as the "pending" version.
- setSecret: Apply the new credential to the actual service (e.g., update the RDS user's password).
- testSecret: Verify the new credential actually works by making a test connection.
- finishSecret: Promote the "pending" version to "current" and demote the old version to "previous" (kept briefly for in-flight connections).
Your applications periodically re-fetch the secret value (or use the AWS SDK's built-in caching client), always receiving the current valid credential. The rotation is invisible to application code.
AWS Secrets Manager vs. HashiCorp Vault
| Dimension | AWS Secrets Manager | HashiCorp Vault |
|---|---|---|
| Operational overhead | Low (fully managed) | High (self-managed) |
| Dynamic secrets | Limited (rotation, not true just-in-time) | Full support (DB, PKI, SSH, AWS, etc.) |
| Multi-cloud / on-prem | AWS-only | Any environment |
| Cost model | Per secret + per API call | Infrastructure cost only |
| Audit integration | CloudTrail | Dedicated audit log |
| Policy language | IAM | HCL-based Vault policies |
Choose AWS Secrets Manager when you are AWS-native and want low operational overhead. Choose Vault when you need true dynamic secrets, multi-cloud support, or advanced features like the PKI engine.