# AWS Secrets Manager alternative: Crunu vs AWS > Crunu vs AWS Secrets Manager: who decrypts your secrets, KMS keys, IAM and OIDC for CI, rotation, audit, hosting and pricing model, from the AWS documentation. URL: https://crunu.com/alternatives/aws-secrets-manager Language: en Updated: 2026-10-30 AWS Secrets Manager decrypts each secret with AWS KMS before returning it, and fits best when every workload runs on AWS with IAM roles. Crunu encrypts on your devices, its server holds no key, and it serves laptops, servers and CI in any cloud. Choose AWS for IAM and rotation, Crunu for a store that can't read values. AWS Secrets Manager decrypts your secrets inside AWS before it hands them out; Crunu's server never holds a key that could. Secrets Manager is the managed secret store of AWS: applications call it at runtime, IAM decides who may read what, KMS keys protect the values, and rotation can update a database password on a schedule. Crunu is a team vault for environment variables, cloud credentials and API keys, encrypted on your devices and delivered to laptops, servers and CI pipelines in any cloud. If everything you run lives on AWS, Secrets Manager is hard to beat for convenience: no credentials to store, IAM roles all the way down. This page is for the cases where that is not the whole picture, such as a team whose `.env` files, laptops and pipelines sit outside AWS, or a policy that the store must be unable to read the values it keeps. > **Note:** We checked every statement about AWS Secrets Manager against the AWS documentation, CLI reference and pricing page on October 30, 2026. Sources are listed with this page. If something is out of date, tell us at . ## Who each one fits **AWS Secrets Manager fits** teams whose workloads run on AWS and can read secrets through IAM roles: Lambda functions, containers on ECS or EKS, EC2 instances. It fits teams that want managed rotation for database credentials, replication across Regions, CloudTrail in their existing audit setup, and no extra vendor. **Crunu fits** teams whose secrets travel beyond one cloud account: developers' `.env` files and `~/.aws/credentials`, servers at several providers, CI on GitHub, GitLab or Bitbucket. It fits teams that want the store to be unable to decrypt values, a key per environment, and a precise report of what a departing person received. ## Side by side | | AWS Secrets Manager | Crunu | | -------------------------- | -------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | | Where values are decrypted | In the service: Secrets Manager decrypts the value with AWS KMS before returning it to the caller | Only in the browser and the `crunu` agent. The server stores ciphertext and signed documents. | | What stays readable | Secret names and descriptions are not encrypted | Organization, project, environment and machine names, email addresses, the audit log, and the size and time of each version | | Keys | Each secret can use its own customer managed KMS key; separating environments is your setup | Each environment has its own key, sealed separately to each person and machine allowed to read it | | Who can read | Any principal that IAM allows to read the secret | People and machines that hold the environment key, with roles Editor, Reader, Specific files and Operator | | CI sign-in | CI jobs assume IAM roles through an OIDC identity provider, such as GitHub Actions | Service tokens bound by OIDC to repository, branch and deployment environment on GitHub Actions, GitLab CI, Bitbucket Pipelines or any issuer | | Rotation | Managed rotation, or a Lambda function that updates the secret and the database or service | Rotates its own encryption keys. Values at providers are reissued by hand, from a checklist. | | Where it runs | A managed AWS service that applications call at runtime | Crunu cloud at app.crunu.com; on the Enterprise plan, also your own server on Docker, Cloudflare Workers, Vercel or Google Cloud Run | | Sync and replication | Replicates secrets across AWS Regions; pushing to other platforms is not documented | Not built in. A CI step can push values with `crunu run`. | | Audit | CloudTrail records API calls and the console shows the last 90 days; secret values are left out of log entries | Hash-chained audit log, 365 days by default and extendable, with JSONL export. Values never reach it. | | Sharing with outsiders | Access goes through IAM; no share-link feature is documented | Share links to selected files with an expiry, a view limit and a password; the key stays in the link after `#` | | Kubernetes | AWS Secrets and Configuration Provider for the Secrets Store CSI Driver on EKS | Not available | | Pricing model | Billed per secret per month and per API call; new AWS accounts get Free Tier credits | Free during early access in the Crunu cloud; self-hosting on the Enterprise plan | ## Who can decrypt your secrets *Figure: Diagram of who can decrypt AWS Secrets Manager values, split into your side and the provider side. On your side, your team’s devices, your machines, and CI runners can decrypt. On the provider side, the AWS Secrets Manager service holds the key and can decrypt values too. Cloud IAM principals with decrypt permission can decrypt as well.* AWS documents this plainly. Secrets Manager encrypts values with AWS KMS keys, and when a caller asks for a value, Secrets Manager decrypts the secret before returning it. Secret names and descriptions are not encrypted at all. A customer managed KMS key changes who controls the key and its policy, but the decryption still happens inside AWS on behalf of whoever IAM lets through. In practice, the set of people who can read a secret is everyone with a matching IAM permission, plus the service itself. That model is a sensible choice for workloads that already trust AWS with everything else. It is a different model from Crunu's. In Crunu, values are encrypted before they leave your device and decrypted only on devices that hold an environment key: a teammate's browser, an enrolled server running `crunu daemon`, or a CI runner with a service token. The server has no key at any point. Access lists and versions are signed, so even a compromised server cannot add itself as a reader. ### When someone leaves With Secrets Manager, people never hold keys, so removing someone means removing their IAM access. CloudTrail records the API calls they made, so you can reconstruct which secrets they read from the trail, then rotate those values. In Crunu, the [member removal flow](https://crunu.com/features/offboarding) does this in one place: it rotates the keys of every environment the person could read, shows which versions they received, when and from where, and lists the values to reissue at each provider. In both cases, values a person already saw stay valid until you reissue them, as the [limitations page](https://crunu.com/security/limitations) explains. ## Where AWS Secrets Manager is stronger - **Native IAM.** Lambda, ECS, EKS and EC2 read secrets through roles, with no credential stored anywhere. Crunu machines enroll with a code and keep a key of their own. - **Rotation of values.** Managed rotation, or a Lambda function that updates both the secret and the database or service. Crunu does not rotate values at providers. - **Scale features.** Replication across AWS Regions, Secrets Store CSI Driver support on EKS, and sign-in through IAM Identity Center with SCIM. Crunu has no Kubernetes, SSO or SCIM support. - **Nothing new to adopt.** It is already part of your AWS account, billing and CloudTrail. Crunu is a new vendor in early access, with no external audit published. ## Moving from AWS Secrets Manager to Crunu > **Note:** Crunu has no importer for AWS Secrets Manager. You read each secret with the AWS CLI on a trusted computer, write the values into `.env` files and drag the files into Crunu. 1. [Create an account](https://crunu.com/signup) and save your Emergency Kit. 2. Create a project for each application and an environment for each stage, for example `payments-api` with `development`, `staging` and `production`. 3. On a trusted computer, run `aws secretsmanager get-secret-value --secret-id payments-api/production --query SecretString --output text` for each secret. 4. Secrets created in the console come back as JSON key/value pairs. Write them as `KEY=VALUE` lines into a `.env` file. 5. Drag the files, or folders such as `.aws`, into the matching environments, then delete the plaintext copies. 6. Start programs with `crunu run --env payments-api/production -- npm start`, enroll servers as machines, and give pipelines service tokens with OIDC binding. Rotation Lambdas, Region replication and IAM-based reads from AWS services have no equivalent in Crunu. You can keep Secrets Manager for workloads inside AWS and move only the team's own environments. > **Warning:** The files from steps 3 and 4 hold plaintext secrets. Keep them out of Git and synced folders, and delete them after the import. ## Other AWS Secrets Manager alternatives Inside AWS, the closest alternative is Systems Manager Parameter Store. Its standard parameters come at no additional charge, and it also uses AWS KMS to decrypt SecureString values when you read them, so the question of who decrypts stays the same. [AWS Secrets Manager vs Parameter Store](https://crunu.com/compare/aws-secrets-manager-vs-aws-parameter-store) explains when each one is enough. If you want one store across clouds, look at [HashiCorp Vault](https://crunu.com/alternatives/hashicorp-vault), compared directly in [HashiCorp Vault vs AWS Secrets Manager](https://crunu.com/compare/hashicorp-vault-vs-aws-secrets-manager). [Doppler](https://crunu.com/alternatives/doppler) and [Infisical](https://crunu.com/alternatives/infisical) can push secrets into AWS Secrets Manager for you, and both decrypt on their own servers. [Google Secret Manager](https://crunu.com/alternatives/google-secret-manager) and [Azure Key Vault](https://crunu.com/alternatives/azure-key-vault) follow the same model as AWS in their clouds. If what you want is a store that cannot read values, look at tools that decrypt on the client: [Phase](https://crunu.com/alternatives/phase), [Bitwarden Secrets Manager](https://crunu.com/alternatives/bitwarden-secrets-manager) and Crunu. The article [customer-managed keys: who decrypts?](https://crunu.com/blog/customer-managed-keys-who-decrypts) explains why a KMS key of your own does not change that answer. ## FAQ ### Is Crunu an alternative to AWS Secrets Manager? Yes, for team secrets that live on laptops, servers and CI pipelines, especially outside AWS. For workloads inside AWS that read secrets through IAM roles and rely on rotation Lambdas, Secrets Manager remains the simpler fit, and you can use both. ### How do I move from AWS Secrets Manager to Crunu? Read each secret with `aws secretsmanager get-secret-value` on a trusted computer, write the key/value pairs into a `.env` file, drag it into a Crunu environment and delete the plaintext copy. Then start programs with `crunu run` and give pipelines OIDC-bound service tokens. ### Can AWS read my secrets in Secrets Manager? The service can. AWS's documentation says Secrets Manager decrypts the secret value before returning it to the caller, and secret names and descriptions are not encrypted. Access is controlled by IAM and KMS policies, and API calls are recorded in CloudTrail. ### Does a customer managed KMS key stop AWS from decrypting? No. A customer managed key gives you control over the key policy and lets you choose a key per secret, but Secrets Manager still uses it inside AWS to decrypt values for callers that IAM allows. Crunu's server never holds a key that decrypts values. ### Can I use Crunu and AWS Secrets Manager together? Yes. One workable split is AWS for workloads inside AWS and Crunu for developers' environments, other clouds and CI. There is no built-in sync between them, but a CI step can push values from Crunu with `crunu run`. ## Sources - [AWS Secrets Manager: Secret encryption and decryption](https://docs.aws.amazon.com/secretsmanager/latest/userguide/security-encryption.html) (accessed 2026-10-30) - [AWS Secrets Manager: What is AWS Secrets Manager?](https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html) (accessed 2026-10-30) - [AWS Secrets Manager: Authentication and access control](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access.html) (accessed 2026-10-30) - [AWS Secrets Manager: Rotate secrets](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html) (accessed 2026-10-30) - [AWS Secrets Manager: Replicate secrets across Regions](https://docs.aws.amazon.com/secretsmanager/latest/userguide/replicate-secrets.html) (accessed 2026-10-30) - [AWS Secrets Manager: Log calls with CloudTrail](https://docs.aws.amazon.com/secretsmanager/latest/userguide/monitoring-cloudtrail.html) (accessed 2026-10-30) - [AWS Secrets Manager: Secrets Store CSI Driver on EKS](https://docs.aws.amazon.com/secretsmanager/latest/userguide/integrating_ascp_irsa.html) (accessed 2026-10-30) - [AWS CLI reference: get-secret-value](https://docs.aws.amazon.com/cli/latest/reference/secretsmanager/get-secret-value.html) (accessed 2026-10-30) - [AWS Secrets Manager API: GetSecretValue](https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html) (accessed 2026-10-30) - [AWS IAM: Create a role for OpenID Connect federation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.html) (accessed 2026-10-30) - [AWS IAM Identity Center: Automatic provisioning](https://docs.aws.amazon.com/singlesignon/latest/userguide/provision-automatically.html) (accessed 2026-10-30) - [AWS Systems Manager: Parameter Store and AWS KMS](https://docs.aws.amazon.com/systems-manager/latest/userguide/secure-string-parameter-kms-encryption.html) (accessed 2026-10-30) - [AWS Systems Manager pricing](https://aws.amazon.com/systems-manager/pricing/) (accessed 2026-10-30) - [AWS Secrets Manager pricing](https://aws.amazon.com/secrets-manager/pricing/) (accessed 2026-10-30) - [Doppler integrations](https://docs.doppler.com/docs/integrations) (accessed 2026-10-30) - [Doppler security fact sheet](https://docs.doppler.com/docs/security-fact-sheet) (accessed 2026-10-30) - [Infisical Secret Syncs](https://infisical.com/docs/integrations/secret-syncs/overview) (accessed 2026-10-30) - [Infisical security internals](https://infisical.com/docs/internals/security) (accessed 2026-10-30) - [Google Cloud Secret Manager: Encryption](https://cloud.google.com/secret-manager/docs/encryption) (accessed 2026-10-30) - [Azure Key Vault: About secrets](https://learn.microsoft.com/en-us/azure/key-vault/secrets/about-secrets) (accessed 2026-10-30) - [Phase security](https://phase.dev/security/) (accessed 2026-10-30) - [Bitwarden Help: Secrets Manager overview](https://bitwarden.com/help/secrets-manager-overview/) (accessed 2026-10-30)