AWS Secrets Manager alternative: Crunu vs AWS
Crunu vs AWS Secrets Manager: who decrypts your secrets, KMS keys, IAM and OIDC for CI, rotation, audit, hosting and pricing model, from the AWS documentation.
The difference in brief
AWS Secrets Manager decrypts each secret with AWS KMS before returning it, and fits best when every workload runs on AWS with IAM roles. Crunu encrypts on your devices, its server holds no key, and it serves laptops, servers and CI in any cloud. Choose AWS for IAM and rotation, Crunu for a store that can't read values.
AWS Secrets Manager is the better pick when
- Every workload runs on AWS and should read secrets through IAM roles, with nothing stored on disk.
- You want managed rotation, or Lambda rotation that updates the database password for you.
- You need replication across AWS Regions or the Secrets Store CSI Driver on EKS.
Crunu is the better pick when
- The service that stores your secrets should never be able to decrypt them, even with your KMS key.
- Your team's .env files, laptops and CI live outside AWS, or across several clouds.
- Removing someone should rotate environment keys and list exactly which values to reissue.
AWS Secrets Manager and Crunu, property by property
The same 14 questions we ask of every tool, answered from AWS Secrets Manager’s own pages and from what Crunu does today. Yes is not always better: read the note.
- Yes
- documented and available
- Partial
- with limits: on some plans, in preview or by hand
- No
- not offered
- n/a
- doesn’t apply, or isn’t documented publicly
| Property | AWS Secrets Manager | Crunuour product | What it changes for you |
|---|---|---|---|
| Decrypted only on your devices | AWS Secrets ManagerNoSecrets Manager decrypts the value with AWS KMS before returning it to the caller. docs.aws.amazon.com · | CrunuYesValues are encrypted and decrypted only in the browser and the crunu agent. crunu.com/security · | If values are decrypted only on devices you control, a breach of the vendor’s servers doesn’t expose them. |
| Server handles plaintext values | AWS Secrets ManagerYesThe service handles plaintext data keys and values; names and descriptions are not encrypted. docs.aws.amazon.com · | CrunuNoThe server holds no decryption key at any point. It still sees metadata such as names, emails and timestamps. crunu.com/security · | Whoever runs a server that handles plaintext, and anyone who breaks into it, could read what passes through. |
| Runs on your own infrastructure | AWS Secrets ManagerNoA managed AWS service that applications call at runtime. docs.aws.amazon.com · | CrunuPartialEnterprise plan only, under a signed agreement: your own server on Docker, Cloudflare Workers, Vercel or Google Cloud Run. crunu.com/self-hosting · | You decide where the data lives and who operates the service. Several tools, Crunu included, offer this only on an enterprise plan. |
| Source code published | AWS Secrets ManagerNoA managed AWS service; its source is not published. docs.aws.amazon.com · | CrunuNoSource code is not published. crunu.com/security/threat-model · | Published code can be read and audited by anyone, and kept running if the vendor changes course. |
| CI signs in with OIDC | AWS Secrets ManagerYesCI jobs assume IAM roles through an OIDC identity provider, such as GitHub Actions. docs.aws.amazon.com · | CrunuYesService tokens bound by OIDC to repository, branch and environment on GitHub Actions, GitLab CI, Bitbucket or any issuer. crunu.com/features/ci-cd · | Pipelines get short-lived access tied to the repository, instead of a long-lived token stored in CI settings. |
| Keys change when someone leaves | AWS Secrets Managern/aNot applicable: users never hold the data keys; the service decrypts on request. docs.aws.amazon.com · | CrunuYesRemoving a member rotates the keys of every environment they could read and lists values to reissue. crunu.com/features/offboarding · | When people hold decryption keys, removing access is complete only once those keys are replaced. |
| Separate key per environment | AWS Secrets ManagerPartialEach secret can use its own customer managed KMS key; separating environments is your setup. docs.aws.amazon.com · | CrunuYesEach environment has its own key, sealed separately to each recipient's public key. crunu.com/features/access-control · | With a key per environment, access to development can’t turn into access to production. |
| Audit log | AWS Secrets ManagerYesAWS CloudTrail records Secrets Manager API calls; the console shows the last 90 days. docs.aws.amazon.com · | CrunuYesHash-chained organization log with one-click verification and JSONL export, kept 365 days by default. crunu.com/features/audit-log · | A record of who changed or fetched what tells you what a person or machine could have seen. |
| Links for people without an account | AWS Secrets ManagerNoAccess goes through IAM; no share-link feature is documented. docs.aws.amazon.com · | CrunuYesLinks for people without an account; the key stays in the URL fragment. Expiry, view limit and password. crunu.com/features/access-links · | Contractors and one-off handovers get a value without it staying in chat history. |
| Free plan or free to use | AWS Secrets ManagerNoBilled per secret per month and per API call; new AWS accounts get Free Tier credits. aws.amazon.com · | CrunuYesFree during early access. crunu.com/pricing · | A small team can start with real projects before anyone signs a contract. |
| Syncs values into other platforms | AWS Secrets ManagerNoReplicates secrets across AWS Regions; pushing to other platforms is not documented. docs.aws.amazon.com · | CrunuNoNo built-in sync to other platforms. CI can push values with crunu run as a recipe. crunu.com/integrations · | Pushing values into clouds and CI saves copying by hand, but the syncing service has to read them. |
| Dynamic secrets | AWS Secrets ManagerNoRotation replaces stored secrets on a schedule; on-demand credentials are not documented. docs.aws.amazon.com · | CrunuNoNot offered by design: generating credentials on demand needs a key on the server. crunu.com/security/limitations · | Credentials created on demand and revoked after a lease limit how long a leaked one works. |
| SSO and SCIM | AWS Secrets ManagerYesThrough AWS IAM Identity Center: sign-in with an external identity provider and SCIM provisioning. docs.aws.amazon.com · | CrunuNoNo SSO or SCIM. People sign in with a password, a Secret Key and an optional second factor. crunu.com/features/access-control · | Sign-in and provisioning from your identity provider make joining and leaving one step. |
| Kubernetes integration | AWS Secrets ManagerYesAWS Secrets and Configuration Provider for the Kubernetes Secrets Store CSI Driver on EKS. docs.aws.amazon.com · | CrunuNoNo Kubernetes operator, Helm chart or CSI provider. crunu.com/integrations · | An operator or CSI driver delivers values into clusters without custom glue code. |
Comparison in detail
On this page
AWS Secrets Manager decrypts your secrets inside AWS before it hands them out; Crunu's server never holds a key that could. Secrets Manager is the managed secret store of AWS: applications call it at runtime, IAM decides who may read what, KMS keys protect the values, and rotation can update a database password on a schedule. Crunu is a team vault for environment variables, cloud credentials and API keys, encrypted on your devices and delivered to laptops, servers and CI pipelines in any cloud.
If everything you run lives on AWS, Secrets Manager is hard to beat for convenience: no credentials to store, IAM roles all the way down. This page is for the cases where that is not the whole picture, such as a team whose .env files, laptops and pipelines sit outside AWS, or a policy that the store must be unable to read the values it keeps.
Who each one fits
AWS Secrets Manager fits teams whose workloads run on AWS and can read secrets through IAM roles: Lambda functions, containers on ECS or EKS, EC2 instances. It fits teams that want managed rotation for database credentials, replication across Regions, CloudTrail in their existing audit setup, and no extra vendor.
Crunu fits teams whose secrets travel beyond one cloud account: developers' .env files and ~/.aws/credentials, servers at several providers, CI on GitHub, GitLab or Bitbucket. It fits teams that want the store to be unable to decrypt values, a key per environment, and a precise report of what a departing person received.
Who can decrypt your secrets
AWS documents this plainly. Secrets Manager encrypts values with AWS KMS keys, and when a caller asks for a value, Secrets Manager decrypts the secret before returning it. Secret names and descriptions are not encrypted at all. A customer managed KMS key changes who controls the key and its policy, but the decryption still happens inside AWS on behalf of whoever IAM lets through. In practice, the set of people who can read a secret is everyone with a matching IAM permission, plus the service itself.
That model is a sensible choice for workloads that already trust AWS with everything else. It is a different model from Crunu's. In Crunu, values are encrypted before they leave your device and decrypted only on devices that hold an environment key: a teammate's browser, an enrolled server running crunu daemon, or a CI runner with a service token. The server has no key at any point. Access lists and versions are signed, so even a compromised server cannot add itself as a reader.
When someone leaves
With Secrets Manager, people never hold keys, so removing someone means removing their IAM access. CloudTrail records the API calls they made, so you can reconstruct which secrets they read from the trail, then rotate those values. In Crunu, the member removal flow does this in one place: it rotates the keys of every environment the person could read, shows which versions they received, when and from where, and lists the values to reissue at each provider. In both cases, values a person already saw stay valid until you reissue them, as the limitations page explains.
Where AWS Secrets Manager is stronger
- Native IAM. Lambda, ECS, EKS and EC2 read secrets through roles, with no credential stored anywhere. Crunu machines enroll with a code and keep a key of their own.
- Rotation of values. Managed rotation, or a Lambda function that updates both the secret and the database or service. Crunu does not rotate values at providers.
- Scale features. Replication across AWS Regions, Secrets Store CSI Driver support on EKS, and sign-in through IAM Identity Center with SCIM. Crunu has no Kubernetes, SSO or SCIM support.
- Nothing new to adopt. It is already part of your AWS account, billing and CloudTrail. Crunu is a new vendor in early access, with no external audit published.
Moving from AWS Secrets Manager to Crunu
- Create an account and save your Emergency Kit.
- Create a project for each application and an environment for each stage, for example
payments-apiwithdevelopment,stagingandproduction. - On a trusted computer, run
aws secretsmanager get-secret-value --secret-id payments-api/production --query SecretString --output textfor each secret. - Secrets created in the console come back as JSON key/value pairs. Write them as
KEY=VALUElines into a.envfile. - Drag the files, or folders such as
.aws, into the matching environments, then delete the plaintext copies. - Start programs with
crunu run --env payments-api/production -- npm start, enroll servers as machines, and give pipelines service tokens with OIDC binding.
Rotation Lambdas, Region replication and IAM-based reads from AWS services have no equivalent in Crunu. You can keep Secrets Manager for workloads inside AWS and move only the team's own environments.
Other AWS Secrets Manager alternatives
Inside AWS, the closest alternative is Systems Manager Parameter Store. Its standard parameters come at no additional charge, and it also uses AWS KMS to decrypt SecureString values when you read them, so the question of who decrypts stays the same. AWS Secrets Manager vs Parameter Store explains when each one is enough.
If you want one store across clouds, look at HashiCorp Vault, compared directly in HashiCorp Vault vs AWS Secrets Manager. Doppler and Infisical can push secrets into AWS Secrets Manager for you, and both decrypt on their own servers. Google Secret Manager and Azure Key Vault follow the same model as AWS in their clouds.
If what you want is a store that cannot read values, look at tools that decrypt on the client: Phase, Bitwarden Secrets Manager and Crunu. The article customer-managed keys: who decrypts? explains why a KMS key of your own does not change that answer.
More facts, row by row
Details beyond the 14 questions above, as this comparison states them.
| AWS Secrets Manager | Crunu | |
|---|---|---|
| Where values are decrypted | In the service: Secrets Manager decrypts the value with AWS KMS before returning it to the caller | Only in the browser and the crunu agent. The server stores ciphertext and signed documents. |
| What stays readable | Secret names and descriptions are not encrypted | Organization, project, environment and machine names, email addresses, the audit log, and the size and time of each version |
| Keys | Each secret can use its own customer managed KMS key; separating environments is your setup | Each environment has its own key, sealed separately to each person and machine allowed to read it |
| Who can read | Any principal that IAM allows to read the secret | People and machines that hold the environment key, with roles Editor, Reader, Specific files and Operator |
| CI sign-in | CI jobs assume IAM roles through an OIDC identity provider, such as GitHub Actions | Service tokens bound by OIDC to repository, branch and deployment environment on GitHub Actions, GitLab CI, Bitbucket Pipelines or any issuer |
| Rotation | Managed rotation, or a Lambda function that updates the secret and the database or service | Rotates its own encryption keys. Values at providers are reissued by hand, from a checklist. |
| Where it runs | A managed AWS service that applications call at runtime | Crunu cloud at app.crunu.com; on the Enterprise plan, also your own server on Docker, Cloudflare Workers, Vercel or Google Cloud Run |
| Sync and replication | Replicates secrets across AWS Regions; pushing to other platforms is not documented | Not built in. A CI step can push values with crunu run. |
| Audit | CloudTrail records API calls and the console shows the last 90 days; secret values are left out of log entries | Hash-chained audit log, 365 days by default and extendable, with JSONL export. Values never reach it. |
| Sharing with outsiders | Access goes through IAM; no share-link feature is documented | Share links to selected files with an expiry, a view limit and a password; the key stays in the link after # |
| Kubernetes | AWS Secrets and Configuration Provider for the Secrets Store CSI Driver on EKS | Not available |
| Pricing model | Billed per secret per month and per API call; new AWS accounts get Free Tier credits | Free during early access in the Crunu cloud; self-hosting on the Enterprise plan |
Sources
Every page this comparison relies on, and the day we last verified it.
- AWS Secrets Manager: Secret encryption and decryption · checked October 30, 2026
- AWS Secrets Manager: What is AWS Secrets Manager? · checked October 30, 2026
- AWS Secrets Manager: Authentication and access control · checked October 30, 2026
- AWS Secrets Manager: Rotate secrets · checked October 30, 2026
- AWS Secrets Manager: Replicate secrets across Regions · checked October 30, 2026
- AWS Secrets Manager: Log calls with CloudTrail · checked October 30, 2026
- AWS Secrets Manager: Secrets Store CSI Driver on EKS · checked October 30, 2026
- AWS CLI reference: get-secret-value · checked October 30, 2026
- AWS Secrets Manager API: GetSecretValue · checked October 30, 2026
- AWS IAM: Create a role for OpenID Connect federation · checked October 30, 2026
- AWS IAM Identity Center: Automatic provisioning · checked October 30, 2026
- AWS Systems Manager: Parameter Store and AWS KMS · checked October 30, 2026
- AWS Systems Manager pricing · checked October 30, 2026
- AWS Secrets Manager pricing · checked October 30, 2026
- Doppler integrations · checked October 30, 2026
- Doppler security fact sheet · checked October 30, 2026
- Infisical Secret Syncs · checked October 30, 2026
- Infisical security internals · checked October 30, 2026
- Google Cloud Secret Manager: Encryption · checked October 30, 2026
- Azure Key Vault: About secrets · checked October 30, 2026
- Phase security · checked October 30, 2026
- Bitwarden Help: Secrets Manager overview · checked October 30, 2026
Questions about Crunu and AWS Secrets Manager
Something else? Write to support@crunu.com
Is Crunu an alternative to AWS Secrets Manager?
Yes, for team secrets that live on laptops, servers and CI pipelines, especially outside AWS. For workloads inside AWS that read secrets through IAM roles and rely on rotation Lambdas, Secrets Manager remains the simpler fit, and you can use both.
How do I move from AWS Secrets Manager to Crunu?
Read each secret with aws secretsmanager get-secret-value on a trusted computer, write the key/value pairs into a .env file, drag it into a Crunu environment and delete the plaintext copy. Then start programs with crunu run and give pipelines OIDC-bound service tokens.
Can AWS read my secrets in Secrets Manager?
The service can. AWS's documentation says Secrets Manager decrypts the secret value before returning it to the caller, and secret names and descriptions are not encrypted. Access is controlled by IAM and KMS policies, and API calls are recorded in CloudTrail.
Does a customer managed KMS key stop AWS from decrypting?
No. A customer managed key gives you control over the key policy and lets you choose a key per secret, but Secrets Manager still uses it inside AWS to decrypt values for callers that IAM allows. Crunu's server never holds a key that decrypts values.
Can I use Crunu and AWS Secrets Manager together?
Yes. One workable split is AWS for workloads inside AWS and Crunu for developers' environments, other clouds and CI. There is no built-in sync between them, but a CI step can push values from Crunu with crunu run.