HashiCorp Vault vs AWS Secrets Manager: Which to Choose?

Decision Summary

HashiCorp Vault

Vault is a secrets lifecycle platform — it generates, stores, rotates, and revokes secrets with fine-grained access control.

Dynamic Secrets (Killer Feature)

Vault generates short-lived, unique credentials on demand:

# Generate a unique PostgreSQL credential (TTL: 1 hour)
vault read database/creds/readonly

# Output:
# Key             Value
# lease_id        database/creds/readonly/abc123
# lease_duration  1h
# username        v-token-readonly-xyz789
# password        A1B2-c3d4-E5F6-g7h8

After 1 hour, Vault automatically revokes the credential. No shared passwords, no rotation needed.

Secrets Engines

Kubernetes Integration

# Vault Agent Injector (sidecar)
apiVersion: apps/v1
kind: Deployment
metadata:
  name: app
spec:
  template:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/role: "app-role"
        vault.hashicorp.com/agent-inject-secret-db: "database/creds/app"
        vault.hashicorp.com/agent-inject-template-db: |
          {{- with secret "database/creds/app" -}}
          export DB_USER={{ .Data.username }}
          export DB_PASS={{ .Data.password }}
          {{- end -}}
    spec:
      serviceAccountName: app
      containers:
        - name: app
          image: myapp:latest

Vault Strengths

• Dynamic secrets — no static credentials to leak
• Multi-cloud — one platform for AWS, Azure, GCP, on-prem
• PKI — full certificate authority with auto-renewal
• Encryption as a service — encrypt data without managing keys
• Namespaces — multi-tenant secret isolation
• Disaster recovery — replication across regions

Vault Challenges

• Operational complexity — unsealing, HA setup, upgrades
• Learning curve — policies, auth methods, engines
• Cost — HCP Vault starts at $0.03/hr ($~22/month) for dev; production is $$$
• Self-hosted burden — backups, monitoring, scaling

AWS Secrets Manager

AWS Secrets Manager is a managed secret storage service with automatic rotation support.

Basic Usage

import boto3
import json

client = boto3.client('secretsmanager', region_name='eu-west-1')

# Store a secret
client.create_secret(
    Name='prod/app/database',
    SecretString=json.dumps({
        'username': 'app_user',
        'password': 'super-secret-123',
        'host': 'db.example.com',
        'port': 5432
    })
)

# Retrieve a secret
response = client.get_secret_value(SecretId='prod/app/database')
secret = json.loads(response['SecretString'])

Automatic Rotation

# Lambda rotation function (simplified)
def lambda_handler(event, context):
    secret_id = event['SecretId']
    step = event['Step']
    
    if step == 'createSecret':
        # Generate new password
        new_password = generate_password()
        client.put_secret_value(
            SecretId=secret_id,
            ClientRequestToken=event['ClientRequestToken'],
            SecretString=json.dumps({'password': new_password}),
            VersionStages=['AWSPENDING']
        )
    elif step == 'setSecret':
        # Update the database with new password
        update_db_password(new_password)
    elif step == 'testSecret':
        # Verify new password works
        test_db_connection(new_password)
    elif step == 'finishSecret':
        # Promote pending to current
        client.update_secret_version_stage(...)

Kubernetes Integration

# External Secrets Operator
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: app-secrets
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: aws-secrets-manager
    kind: ClusterSecretStore
  target:
    name: app-secrets
  data:
    - secretKey: DB_PASSWORD
      remoteRef:
        key: prod/app/database
        property: password

Secrets Manager Strengths

• Zero ops — fully managed, no infrastructure
• Native AWS integration — IAM policies, CloudTrail, RDS rotation
• Simple — store and retrieve, rotation via Lambda
• Cross-account sharing — resource-based policies
• Versioning — automatic version history

Secrets Manager Limitations

• AWS only — no multi-cloud
• No dynamic secrets — rotation is scheduled, not on-demand
• No PKI — use ACM for certificates
• Cost at scale — $0.40/secret/month × 1000 secrets = $400/month
• API cost — $0.05 per 10,000 API calls

Cost Comparison (1000 secrets, 100 apps)

When to Choose

Choose Vault when:

• Multi-cloud or hybrid infrastructure
• Need dynamic secrets (database, cloud, SSH)
• PKI / certificate management required
• Encryption as a service needed
• Complex access policies across teams
• On-premises secrets management

Choose Secrets Manager when:

• AWS-only infrastructure
• Simple store-and-retrieve use case
• Want zero operational burden
• RDS/Aurora automatic rotation needed
• Small-medium secret count (under 500)
• Team lacks Vault expertise

Use Both:

Many enterprises use Vault as the central secrets platform but sync specific secrets to Secrets Manager for AWS-native service integration (Lambda, ECS, RDS).

Related Articles

• Kubernetes Secrets Management Best Practices
• CDK vs Terraform 2026
• EKS vs GKE vs AKS 2026