Secrets at Scale: Vault's Flexibility vs AWS's Frictionless Ease

---

```

Opening:

Every infrastructure decision eventually hits the secrets wall. You've got database passwords, API keys, service tokens, TLS certs — and they're scattered across config files, CI pipelines, and the last engineer's laptop. The fix is a secrets manager. But which one?

The two names that dominate every shortlist — HashiCorp Vault and AWS Secrets Manager — represent opposite philosophies. Vault is a platform: a Swiss Army chainsaw with dynamic credentials, PKI, and encryption-as-a-service. AWS Secrets Manager is a service: a clean, AWS-native vault that stores your secrets and gets out of your way. Choosing between them is less about features and more about your team's operational capacity.

The quick answer: If your entire infrastructure lives in AWS and you don't have a dedicated security engineer, buy AWS Secrets Manager. If you're running Kubernetes across multiple clouds, need short-lived database credentials, or want one secrets plane for the whole company, Vault is worth the learning curve.

Quick Comparison Table:

Feature-by-Feature Deep Dive — I'll do 7 features.

1. Secret Storage & Encryption

Vault encrypts everything before it touches storage. The encryption key is wrapped by a master key, and you distribute the master key via Shamir's Secret Sharing — the famous "unseal" ritual where five keyholders split the ability to decrypt. It sounds dramatic, but it means a single compromised machine can't silently decrypt your secrets. Enterprise tiers add HSM integration, so the root key lives in a tamper-resistant hardware module. Vault also keeps up to 10 versions of each secret (configurable), so a bad update is one command away from a rollback.

AWS Secrets Manager takes a simpler route. Every secret is encrypted with KMS — you can use the default AWS-managed key or bring your own CMK. The encryption story is solid; KMS is one of the most battle-tested key management systems on the planet. Versioning works differently: AWS keeps versions with staging labels (AWSCURRENT, AWSPREVIOUS) and supports up to 100 versions per secret. You can't delete a secret instantly — there's a minimum 7-day recovery window, which is a nice safety net.

Winner: Vault, narrowly. The Shamir unseal model and HSM support are genuinely stronger for high-security environments. But if you already trust KMS (and you should), AWS's approach is less ceremony for the same practical outcome.

1. Dynamic Secrets & Leases

This is the round that ends the fight. Vault's database engines don't just store passwords — they generate them on demand. Ask for a Postgres credential, and Vault creates a database user with exactly the permissions you requested, hands you a 24-hour lease, and deletes the user when the lease expires. The same pattern works for AWS IAM users, cloud provider credentials, and even SSH keys.

The security win is enormous. Static secrets live forever; they leak in logs, get pasted into Slack, and survive employee departures. Dynamic secrets are born with an expiration date. Even if a credential leaks, it's worthless in a few hours.

AWS Secrets Manager doesn't do this. At all. It stores static secrets and rotates them — meaning it generates a new random password on a schedule and updates both the stored secret and (if you set it up) the target service. But the credential still lives in your application config. AWS has no concept of a lease or a short-lived credential.

Winner: Vault, decisively. If dynamic secrets are on your requirements list, stop reading and buy Vault. This is the single biggest functional gap between the two tools.

1. Rotation Automation

AWS's rotation story is genuinely good — for static secrets. You enable rotation on a secret, pick a schedule (say, every 30 days), and AWS invokes a Lambda function that generates a new value and pushes it to the target service. For RDS, Aurora, Redshift, and DocumentDB, AWS provides ready-made rotation templates. You write almost no code. For everything else, you write your own Lambda — which is fiddly but well-documented.

Vault's rotation story is different because it doesn't need to exist. Dynamic database credentials rotate every time a lease renews. For the root credentials Vault uses to connect to a database, Vault can rotate them on demand. There's also a transit engine that can rotate encryption keys. But if you want to rotate a static secret — the kind AWS rotates — Vault makes you build a workflow. It's not the tool's natural mode.

Winner: AWS. If you're managing static secrets against AWS data services, Secrets Manager's rotation is the least-work path. Vault's dynamic model is superior overall, but AWS wins this specific round.

1. Access Control & Policy Engine

Vault's policy model is path-based and granular to the point of absurdity. Every secret lives at a path — secret/data/production/postgres — and you write policies that grant read, write, or list permissions on specific paths. You can scope by auth method (Kubernetes service account, LDAP group, OIDC claim), and Enterprise adds namespaces for hard multi-tenant isolation. It's the most flexible access model in the secrets management space.

AWS Secrets Manager uses IAM, which is powerful but has a different shape. You attach policies to roles or users, and you scope permissions by secret ARN, resource tag, or VPC endpoint. IAM's policy language is verbose, and the permission-boundary model confuses every new engineer at least once. It works — AWS runs on it — but it's not purpose-built for secrets. You'll spend real time translating "this app should read these secrets" into IAM statements.

Winner: Vault. The path-based model maps to how engineers actually think about secrets. IAM is a general-purpose tool; Vault's policies are surgical.

1. Audit Logging & Compliance

Every Vault request produces an audit record: who (token and identity), what (path), when, and the response. You can stream audit logs to syslog, a file, or a socket, and the logs are tamper-evident — each entry links to the previous one. This is the kind of detail compliance auditors actually check. Enterprise adds control