# HashiCorp Vault vs AWS Secrets Manager compared > HashiCorp Vault and AWS Secrets Manager compared: what you operate, cost model, dynamic secrets, rotation, CI access and who decrypts, from both vendors' docs. URL: https://crunu.com/compare/hashicorp-vault-vs-aws-secrets-manager Language: en Updated: 2026-10-30 Vault is a secrets platform you run, or buy as HCP Vault Dedicated, with dynamic secrets, many auth methods and any cloud. AWS Secrets Manager is a managed AWS service billed per secret and per API call, with IAM access and rotation built in. Both decrypt on the server before returning a value. The main difference between HashiCorp Vault and AWS Secrets Manager is who runs the server. Vault is software you deploy and operate yourself, or buy as the managed HCP Vault Dedicated, and it works the same on any cloud or on premises. AWS Secrets Manager is a managed AWS service: nothing to install, access through IAM, and a bill per secret and per API call. Both encrypt secrets at rest and decrypt them on the server before handing them to an authorized caller. Vault does far more than store secrets: it generates database and cloud credentials on demand, issues certificates and offers encryption as a service. If you only need to store and rotate secrets for workloads on AWS, that breadth is something you pay for in operations. > **Note:** Crunu wrote this comparison. We make a third option, described near the end, and we compared Vault and AWS Secrets Manager using only HashiCorp, IBM and AWS documentation, checked on October 30, 2026. Sources are listed with this page. If something is out of date, tell us at . ## Who each one fits **HashiCorp Vault fits** teams with workloads across several clouds, data centers or Kubernetes clusters that want one secrets platform for all of them. It fits teams that need dynamic secrets, such as database credentials created per request and revoked when the lease ends, and that have people to run it. HashiCorp is now an IBM company; Vault Community edition is self-managed, and Vault Enterprise is self-managed or available as HCP Vault Dedicated. **AWS Secrets Manager fits** teams whose applications run on AWS. Applications replace hard-coded credentials with a runtime call to the service, IAM policies decide who can read each secret, and CloudTrail records the calls. Managed rotation covers many AWS-managed secrets without a Lambda function you maintain. ## Side by side | | HashiCorp Vault | AWS Secrets Manager | | -------------------------- | -------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- | | What you run | Community or Enterprise on your own servers, or HCP Vault Dedicated managed by HashiCorp | Nothing; a managed AWS service | | Where values are decrypted | On the Vault server: its barrier decrypts data from storage once Vault is unsealed | In the service, which decrypts the value with AWS KMS before returning it | | Starting the server | Starts sealed; unseal with key shares or auto unseal through a cloud KMS or, on Enterprise, an HSM | Not applicable | | License | Business Source License 1.1 from version 1.15; each version converts to MPL 2.0 after four years | Proprietary managed service | | Dynamic secrets | Database and cloud engines create credentials on demand and revoke them when the lease ends | Not documented; managed rotation, or a Lambda function, replaces stored secrets on a schedule | | Access control | Policies on paths, with many auth methods, including JWT and OIDC | IAM policies and resource-based policies on each secret | | CI pipelines | JWT/OIDC auth method with bound claims, usable from GitHub Actions and other CI | CI jobs assume IAM roles through an OIDC identity provider | | Audit | Audit devices record all requests and responses, with most strings HMAC-hashed by default | CloudTrail records API calls; the console shows the last 90 days | | Multi-region | Performance and disaster recovery replication on Enterprise | Replication of secrets across AWS Regions | | Kubernetes | Helm chart, Vault Secrets Operator, CSI provider and Agent Injector | AWS Secrets and Configuration Provider for the Secrets Store CSI Driver on EKS | | Pricing model | Community is free to run under its license; Enterprise and HCP Vault Dedicated are paid | Per secret per month and per 10,000 API calls; replicas are billed as separate secrets | ## What you operate, and what it costs AWS publishes simple arithmetic. The worked examples on its pricing page use $0.40 per secret per month and $0.05 per 10,000 API calls, with each replica in another Region billed as its own secret and secrets stored for less than a month prorated by the hour. New AWS customers get Free Tier credits that can be applied to Secrets Manager. At those rates, 100 secrets read 3,000 times a day in total come to about $40 a month, and nobody is on call for the service. Vault Community costs nothing to license for most uses: its license allows production use except for competing hosted offerings. The cost is the work. A Vault server starts sealed, and in the default configuration operators must enter a threshold of key shares to unseal each node after a restart; HashiCorp's own documentation calls unsealing with Shamir seals "a manual process" and says auto unseal through a cloud KMS gives most users a better experience. Community edition also lacks namespaces, performance and disaster recovery replication, and secrets sync, which are Enterprise features. HCP Vault Dedicated removes the operations work as a paid managed service. One more change matters if you read older comparisons. HCP Vault Secrets, HashiCorp's lighter managed product, reached end of sale on June 30, 2025 and end of life no later than July 1, 2026, according to IBM support. Its users were pointed to HCP Vault Dedicated or Vault Community. ## Who can decrypt The two products agree on the model. Vault's barrier encrypts data before it reaches storage, and "once Vault retrieves the encryption key, it decrypts the data in the storage backend, and enters the unsealed state". An unsealed Vault server can therefore read every secret it holds and returns plaintext to clients whose policies allow it. *Figure: Diagram of who can decrypt HashiCorp Vault values, split into your side and the provider side. On your side, your team’s devices, your machines, and CI runners can decrypt. On the provider side, the HashiCorp Vault server holds the key and can decrypt values too.* AWS says the same of Secrets Manager: it "decrypts the secret value before returning it to the caller". You can choose a customer managed KMS key per secret, which controls who may use that key through IAM, but the service still performs the decryption. Secret names and descriptions are not encrypted. *Figure: Diagram of who can decrypt AWS Secrets Manager values, split into your side and the provider side. On your side, your team’s devices, your machines, and CI runners can decrypt. On the provider side, the AWS Secrets Manager service holds the key and can decrypt values too. Cloud IAM principals with decrypt permission can decrypt as well.* That is a design choice, and it means the operator of the server, your Vault administrators or AWS and your IAM administrators, sits inside the trust boundary of every secret. ## Where Vault is stronger - **Dynamic secrets.** Database and cloud credentials can be generated for each request and revoked when the lease ends. Secrets Manager rotates stored secrets on a schedule instead. - **Any cloud or none.** Vault runs on any infrastructure and authenticates workloads from many platforms. Secrets Manager is tied to AWS. - **More than secrets.** Vault adds a PKI secrets engine for certificates, the transit engine for encryption as a service, and many auth methods, all in one platform. - **Response wrapping.** Vault can return a single-use token in place of a secret, so the value is fetched only once by the intended recipient. ## Where AWS Secrets Manager is stronger - **Nothing to operate.** No servers, no unseal, no upgrades and no on-call rotation for the vault itself. - **IAM everywhere.** Access uses the same IAM roles your workloads already have, and CI jobs can assume them through OIDC. - **Managed rotation.** Many AWS-managed secrets rotate without a Lambda function you maintain. - **Predictable cost for small setups.** A small number of secrets costs a few dollars a month, with no cluster to size. ## A third option: Crunu Crunu, which wrote this page, is built for teams that want neither a cluster to run nor a server that can decrypt. Values are encrypted in the browser and the `crunu` agent, and the server stores only ciphertext; each environment has its own key, sealed to each person, machine and pipeline that may read it. Pipelines use service tokens bound by OIDC to a repository, branch and deployment environment on GitHub Actions, GitLab CI or Bitbucket Pipelines. You can use the Crunu cloud or, on the Enterprise plan, [host the server yourself](https://crunu.com/self-hosting) on Docker, Cloudflare Workers, Vercel or Google Cloud Run, with no unseal step. It is free during early access. The server still sees metadata such as names, email addresses and timestamps, as the [limitations page](https://crunu.com/security/limitations) explains. Crunu is not a fit if you need dynamic secrets, PKI, encryption as a service, IAM-native access for AWS workloads, managed rotation or Kubernetes integration; it has none of these, and dynamic secrets are left out by design because they need a key on the server. The full comparisons are [Crunu vs HashiCorp Vault](https://crunu.com/alternatives/hashicorp-vault) and [Crunu vs AWS Secrets Manager](https://crunu.com/alternatives/aws-secrets-manager). If you are choosing inside AWS, see [AWS Secrets Manager vs Parameter Store](https://crunu.com/compare/aws-secrets-manager-vs-aws-parameter-store). ## FAQ ### Is HashiCorp Vault cheaper than AWS Secrets Manager? Vault Community has no license fee for most uses, but you pay for the servers, storage and people to run, unseal and upgrade it. AWS Secrets Manager has no operations work but bills per secret per month and per 10,000 API calls. For a small number of secrets on AWS, the Secrets Manager bill is a few dollars a month, with no servers to run. ### Does AWS Secrets Manager support dynamic secrets? Not in the sense Vault does. Secrets Manager rotates stored secrets on a schedule, through managed rotation or a Lambda function, while Vault's database and cloud engines create new credentials for each request and revoke them when the lease ends. ### Can AWS or my Vault server read my secrets? Yes, in both cases. AWS Secrets Manager decrypts the value with AWS KMS before returning it to the caller, and an unsealed Vault server decrypts data from its storage backend to answer requests. A customer managed KMS key controls who may use the key, not where decryption happens. ### What happened to HCP Vault Secrets? IBM support lists end of sale on June 30, 2025 and end of life at the earlier of the Flex contract expiry or July 1, 2026, after which applications are deleted. HashiCorp pointed users to HCP Vault Dedicated or Vault Community edition. ### Can I use both Vault and AWS Secrets Manager? Yes. Vault's secrets sync, on Enterprise or HCP Vault Dedicated, can push secrets to external destinations, and you can keep application secrets in Secrets Manager while using Vault for dynamic credentials or PKI. Keep each secret in one source of truth. ## Sources - [Vault architecture](https://developer.hashicorp.com/vault/docs/internals/architecture) (accessed 2026-10-30) - [Vault seal and unseal](https://developer.hashicorp.com/vault/docs/concepts/seal) (accessed 2026-10-30) - [Vault editions](https://developer.hashicorp.com/vault/tutorials/get-started/available-editions) (accessed 2026-10-30) - [Vault license (BSL 1.1)](https://github.com/hashicorp/vault/blob/main/LICENSE) (accessed 2026-10-30) - [Vault JWT/OIDC auth method](https://developer.hashicorp.com/vault/docs/auth/jwt) (accessed 2026-10-30) - [Vault database secrets engine](https://developer.hashicorp.com/vault/docs/secrets/databases) (accessed 2026-10-30) - [Vault PKI secrets engine](https://developer.hashicorp.com/vault/docs/secrets/pki) (accessed 2026-10-30) - [Vault transit secrets engine](https://developer.hashicorp.com/vault/docs/secrets/transit) (accessed 2026-10-30) - [Vault audit devices](https://developer.hashicorp.com/vault/docs/audit) (accessed 2026-10-30) - [Vault secrets sync](https://developer.hashicorp.com/vault/docs/sync) (accessed 2026-10-30) - [Vault on Kubernetes](https://developer.hashicorp.com/vault/docs/deploy/kubernetes) (accessed 2026-10-30) - [IBM completes acquisition of HashiCorp](https://newsroom.ibm.com/2025-02-27-ibm-completes-acquisition-of-hashicorp,-creates-comprehensive,-end-to-end-hybrid-cloud-platform) (accessed 2026-10-30) - [IBM support: HCP Vault Secrets end of life](https://www.ibm.com/support/pages/node/7263986) (accessed 2026-10-30) - [AWS Secrets Manager encryption](https://docs.aws.amazon.com/secretsmanager/latest/userguide/security-encryption.html) (accessed 2026-10-30) - [AWS Secrets Manager pricing](https://aws.amazon.com/secrets-manager/pricing/) (accessed 2026-10-30) - [AWS Secrets Manager rotation](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html) (accessed 2026-10-30) - [AWS Secrets Manager quotas](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_limits.html) (accessed 2026-10-30) - [AWS Secrets Manager replication](https://docs.aws.amazon.com/secretsmanager/latest/userguide/replicate-secrets.html) (accessed 2026-10-30) - [Vault response wrapping](https://developer.hashicorp.com/vault/docs/concepts/response-wrapping) (accessed 2026-10-30) - [AWS Secrets Manager logging with CloudTrail](https://docs.aws.amazon.com/secretsmanager/latest/userguide/monitoring-cloudtrail.html) (accessed 2026-10-30) - [AWS IAM: OIDC identity providers](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.html) (accessed 2026-10-30) - [AWS Secrets and Configuration Provider for EKS](https://docs.aws.amazon.com/secretsmanager/latest/userguide/integrating_ascp_irsa.html) (accessed 2026-10-30)