HashiCorp Vault vs AWS Secrets Manager compared

The main difference between HashiCorp Vault and AWS Secrets Manager is who runs the server. Vault is software you deploy and operate yourself, or buy as the managed HCP Vault Dedicated, and it works the same on any cloud or on premises. AWS Secrets Manager is a managed AWS service: nothing to install, access through IAM, and a bill per secret and per API call. Both encrypt secrets at rest and decrypt them on the server before handing them to an authorized caller.

Vault does far more than store secrets: it generates database and cloud credentials on demand, issues certificates and offers encryption as a service. If you only need to store and rotate secrets for workloads on AWS, that breadth is something you pay for in operations.

Who each one fits

HashiCorp Vault fits teams with workloads across several clouds, data centers or Kubernetes clusters that want one secrets platform for all of them. It fits teams that need dynamic secrets, such as database credentials created per request and revoked when the lease ends, and that have people to run it. HashiCorp is now an IBM company; Vault Community edition is self-managed, and Vault Enterprise is self-managed or available as HCP Vault Dedicated.

AWS Secrets Manager fits teams whose applications run on AWS. Applications replace hard-coded credentials with a runtime call to the service, IAM policies decide who can read each secret, and CloudTrail records the calls. Managed rotation covers many AWS-managed secrets without a Lambda function you maintain.

What you operate, and what it costs

AWS publishes simple arithmetic. The worked examples on its pricing page use $0.40 per secret per month and $0.05 per 10,000 API calls, with each replica in another Region billed as its own secret and secrets stored for less than a month prorated by the hour. New AWS customers get Free Tier credits that can be applied to Secrets Manager. At those rates, 100 secrets read 3,000 times a day in total come to about $40 a month, and nobody is on call for the service.

Vault Community costs nothing to license for most uses: its license allows production use except for competing hosted offerings. The cost is the work. A Vault server starts sealed, and in the default configuration operators must enter a threshold of key shares to unseal each node after a restart; HashiCorp's own documentation calls unsealing with Shamir seals "a manual process" and says auto unseal through a cloud KMS gives most users a better experience. Community edition also lacks namespaces, performance and disaster recovery replication, and secrets sync, which are Enterprise features. HCP Vault Dedicated removes the operations work as a paid managed service.

One more change matters if you read older comparisons. HCP Vault Secrets, HashiCorp's lighter managed product, reached end of sale on June 30, 2025 and end of life no later than July 1, 2026, according to IBM support. Its users were pointed to HCP Vault Dedicated or Vault Community.

Who can decrypt

The two products agree on the model. Vault's barrier encrypts data before it reaches storage, and "once Vault retrieves the encryption key, it decrypts the data in the storage backend, and enters the unsealed state". An unsealed Vault server can therefore read every secret it holds and returns plaintext to clients whose policies allow it.

AWS says the same of Secrets Manager: it "decrypts the secret value before returning it to the caller". You can choose a customer managed KMS key per secret, which controls who may use that key through IAM, but the service still performs the decryption. Secret names and descriptions are not encrypted.

That is a design choice, and it means the operator of the server, your Vault administrators or AWS and your IAM administrators, sits inside the trust boundary of every secret.

Where Vault is stronger

• Dynamic secrets. Database and cloud credentials can be generated for each request and revoked when the lease ends. Secrets Manager rotates stored secrets on a schedule instead.
• Any cloud or none. Vault runs on any infrastructure and authenticates workloads from many platforms. Secrets Manager is tied to AWS.
• More than secrets. Vault adds a PKI secrets engine for certificates, the transit engine for encryption as a service, and many auth methods, all in one platform.
• Response wrapping. Vault can return a single-use token in place of a secret, so the value is fetched only once by the intended recipient.

Where AWS Secrets Manager is stronger

• Nothing to operate. No servers, no unseal, no upgrades and no on-call rotation for the vault itself.
• IAM everywhere. Access uses the same IAM roles your workloads already have, and CI jobs can assume them through OIDC.
• Managed rotation. Many AWS-managed secrets rotate without a Lambda function you maintain.
• Predictable cost for small setups. A small number of secrets costs a few dollars a month, with no cluster to size.

A third option: Crunu

Crunu, which wrote this page, is built for teams that want neither a cluster to run nor a server that can decrypt. Values are encrypted in the browser and the crunu agent, and the server stores only ciphertext; each environment has its own key, sealed to each person, machine and pipeline that may read it. Pipelines use service tokens bound by OIDC to a repository, branch and deployment environment on GitHub Actions, GitLab CI or Bitbucket Pipelines. You can use the Crunu cloud or, on the Enterprise plan, host the server yourself on Docker, Cloudflare Workers, Vercel or Google Cloud Run, with no unseal step. It is free during early access. The server still sees metadata such as names, email addresses and timestamps, as the limitations page explains.

Crunu is not a fit if you need dynamic secrets, PKI, encryption as a service, IAM-native access for AWS workloads, managed rotation or Kubernetes integration; it has none of these, and dynamic secrets are left out by design because they need a key on the server. The full comparisons are Crunu vs HashiCorp Vault and Crunu vs AWS Secrets Manager. If you are choosing inside AWS, see AWS Secrets Manager vs Parameter Store.