AWS Secrets Manager
The obvious answer if everything already runs in AWS.
If your workloads are on AWS, Secrets Manager is already available, already inside your IAM boundary, and already covered by your compliance paperwork. It does rotation with Lambda, integrates natively with RDS, ECS and EKS, and requires no new infrastructure of any kind. It is priced per secret per month plus API calls, which is cheap for dozens of secrets and less cheap for thousands. The obvious limitation is the obvious one: it is AWS-only, so a multi-cloud estate ends up running something else alongside it, which defeats the point of a central secrets store.
What it does well
- +Already inside your existing IAM, VPC and compliance envelope
- +Native rotation with RDS, Redshift and DocumentDB
- +Zero infrastructure to run or patch
- +Cheap at small secret counts
Where it falls short
- −AWS-only — useless as a central store in a multi-cloud estate
- −Per-secret pricing adds up quickly at scale
- −Far less capable than Vault for dynamic credentials and PKI
- −Deepens AWS lock-in rather than reducing it
AWS Secrets Manager as an alternative to
Where AWS Secrets Manager shows up in our comparisons, and how it ranked.
AWS Secrets Manager head-to-head
Straight comparisons against the tools people weigh it against.