OpenBao vs AWS Secrets Manager
Both are alternatives to HashiCorp Vault. Here's how they stack up — verified facts, no spin.
Also searched as AWS Secrets Manager vs OpenBao — same comparison, one verdict.
OpenBao
TOP PICKVault before the licence changed — forked, MPL-2.0, run by a foundation.
OpenBao is the Linux Foundation's fork of Vault, taken from the last release before the Business Source License and continued under MPL-2.0. It is not a reimplementation or a lookalike: it is the same codebase, so the API, the CLI, the policy language and the storage format are Vault's, and migration is closer to a rename than a port. Governance is the whole point — it sits under a foundation with multiple corporate contributors rather than a single vendor who can change the terms again. Around 6.9k stars and actively developed. If your reason for looking is the licence rather than the product, this is the answer and there is not much more to decide.
AWS Secrets Manager
The obvious answer if everything already runs in AWS.
If your workloads are on AWS, Secrets Manager is already available, already inside your IAM boundary, and already covered by your compliance paperwork. It does rotation with Lambda, integrates natively with RDS, ECS and EKS, and requires no new infrastructure of any kind. It is priced per secret per month plus API calls, which is cheap for dozens of secrets and less cheap for thousands. The obvious limitation is the obvious one: it is AWS-only, so a multi-cloud estate ends up running something else alongside it, which defeats the point of a central secrets store.
Side by side
| OpenBao | AWS Secrets Manager | |
|---|---|---|
| Sovereignty Score | 94 | 35 |
| Open source | Yes | No |
| Self-hostable | Yes | No |
| Local-first | Yes | No |
| License | MPL-2.0 | Proprietary (hosted service) |
| Pricing | Free and open source. You run it on your own infrastructure. | Roughly $0.40 per secret per month plus a small per-10,000-API-call charge. Rates checked 2026-07-31. |
OpenBao is Macrostack's recommended HashiCorp Vault alternative, so it's our pick here.
OpenBao
Strengths
- +The same codebase — migration from Vault is close to drop-in
- +MPL-2.0 under Linux Foundation governance, not a single vendor's discretion
- +Keeps Vault's dynamic secrets, PKI and transit engines
- +Existing Vault knowledge, tooling and Terraform providers transfer directly
Trade-offs
- −Inherits Vault's operational difficulty in full — this is not the easy option
- −Smaller community than Vault, and the ecosystem is still catching up
- −No enterprise namespaces or vendor support contract
- −Divergence from upstream Vault will grow over time
AWS Secrets Manager
Strengths
- +Already inside your existing IAM, VPC and compliance envelope
- +Native rotation with RDS, Redshift and DocumentDB
- +Zero infrastructure to run or patch
- +Cheap at small secret counts
Trade-offs
- −AWS-only — useless as a central store in a multi-cloud estate
- −Per-secret pricing adds up quickly at scale
- −Far less capable than Vault for dynamic credentials and PKI
- −Deepens AWS lock-in rather than reducing it
Related alternative guides
Facts verified 2026-07-31. Licenses and pricing change — spotted something out of date? That's a correction we want.