AWS Secrets Manager vs HashiCorp Vault

At a glance

If your workloads live in AWS, use AWS Secrets Manager. It costs 0.40 dollars per secret per month, IAM controls access, CloudTrail logs every call, and there is nothing to run. If you are multi-cloud or hybrid, or you need short-lived credentials minted on demand, use HashiCorp Vault, as long as you have platform engineers to operate it. Many teams run both: Vault as the cross-cloud standard, and Secrets Manager at the AWS-native edges.

Where each wins

Pricing reality (checked 2026-11-05)

The AWS pricing page lists 0.40 dollars per secret per month and 0.05 dollars per 10,000 API calls. Creating new versions during rotation is free. AWS's own examples put 15 secrets at 6.02 dollars a month and 10,000 secrets with 12 million calls at 4,060 dollars. High-read workloads that skip client-side caching pay for every call. New accounts can use AWS Free Tier credits against it, but there is no permanent free allowance.

Vault Community is free to self-host. The real cost is the engineers who run it. HashiCorp's pricing page publishes Terraform tiers but no Vault prices. HCP Vault Dedicated bills per cluster-hour plus per unique active client per month, and Enterprise Self-Managed is quote-only. Model both, including Vault's staffing cost, in the TCO calculator.

Ownership

IBM completed its acquisition of HashiCorp on 27 February 2025 at a 6.4 billion dollar enterprise value, and business operations moved to IBM on 1 September 2025. The self-managed product is sold as IBM Vault Self-Managed. Vault has been under BUSL 1.1 since August 2023, so it is source-available rather than open source. That gave rise to OpenBao, the Linux Foundation fork. HCP Vault Secrets reached end of life on 1 July 2026, so any comparison still quoting it is out of date. AWS Secrets Manager has no ownership change to track.

Deployment and architecture

Secrets Manager is a regional AWS service. It offers three rotation paths: managed rotation for supported AWS-managed secrets, managed external secrets for partner systems, and Lambda functions for everything else. Workloads outside AWS can reach it, but only by authenticating to AWS IAM first.

Vault is a cluster you run, or rent through HCP. It issues credentials rather than just storing them. Its AWS engine, for example, returns assumed-role, federation-token or session-token credentials with a TTL such as 60 minutes, or creates an IAM user that it deletes when the lease expires. The same pattern covers databases and other clouds, and it shrinks the exposure window that secrets in repositories and CI create.

Migration notes

You rarely need a full migration. Vault secrets sync pushes secrets one way from Vault into AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, GitHub Actions and Vercel, so AWS-native consumers keep reading Secrets Manager while Vault stays the source of truth. It needs Vault Enterprise or HCP Vault Dedicated, and each synced secret counts as an HCP client. Going the other way, from Vault to Secrets Manager, means re-creating static secrets and replacing dynamic credentials with rotation schedules. That trade usually lengthens credential lifetimes.

Who should pick which

• AWS Secrets Manager: AWS-only estates, teams without platform engineers, and RDS, Aurora or Redshift credentials that need managed rotation.
• Vault: multi-cloud or on-premises estates, teams that want dynamic database and cloud credentials, PKI and encryption as a service in one place, and a platform team to run it.
• Neither: if you want hosted, developer-first secrets without AWS lock-in, see Doppler vs Infisical. If the BUSL licence is the blocker, evaluate OpenBao. See also Akeyless vs Vault and the best secrets management tools. Our HashiCorp Vault alternatives guide compares seven options.