--- title: "AWS Secrets Manager Alternatives: Managed, Open-Source, and Multi-Cloud Options" canonical: "https://infisical.com/blog/aws-secrets-manager-alternatives" published: "2025-01-02" last-updated: "2026-11-10" tags: ["Resources"] source-index: https://infisical.com/llms.txt --- # AWS Secrets Manager Alternatives: Managed, Open-Source, and Multi-Cloud Options [AWS Secrets Manager](https://infisical.com/blog/aws-secrets-manager-complete-guide) is a sensible default if you exclusively run on AWS because it natively connects with so many services. But Secrets Manager crumbles when the setup grows: * a GitHub Actions workflow that needs a deploy token * a Google Cloud project that came with an acquisition * a third-party API key nobody rotates because rotating it means writing and maintaining another Lambda function. Each of these usually ends up elsewhere or requires yet another function, which means there’s no centralized overview of where each secret lives and what uses it. As organizations scale, so does the bill, because every environment, account, and region bills its copy as a secret. Teams usually explore alternatives because AWS Secrets Manager gives them no centralized overview and the Lambda functions and workarounds become too much overhead to maintain. Most teams opt for a [dedicated secrets manager](https://infisical.com/blog/secrets-management-complete-guide) like Infisical that can sync with AWS Secrets Manager so AWS workloads can continue to pull secrets as they used to. ## How the AWS Secrets Manager alternatives compare
| Tool | Best for | Deployment | Open source | Rotation and dynamic secrets | What it takes to run | | :---- | :---- | :---- | :---- | :---- | :---- | | Infisical | Teams whose secrets span AWS and everything else | Cloud or self-hosted | MIT core | 30+ rotation and 30+ dynamic targets | Nothing in the cloud, PostgreSQL and Redis self-hosted | | Parameter Store | Configuration and low-risk secrets on AWS | Managed, AWS only | ✗ | ✗ | Nothing | | [HashiCorp Vault](https://infisical.com/compare/infisical-vs-hashicorp-vault) | Platform teams with people to run it | Self-hosted or HCP Vault Dedicated | Source-available (BSL) | Dynamic for databases, clouds, Kubernetes, LDAP, and SSH | A cluster and Vault specialists | | OpenBao | Teams that want Vault's model under an open-source license | Self-hosted | MPL-2.0 | Dynamic for five databases, Kubernetes, LDAP, and SSH | A Vault-style cluster with a key generation ceremony and other operational hurdles | | [Doppler](https://infisical.com/infisical-vs-doppler) | Product teams that want hosted environment variables | SaaS, on-prem on Enterprise | ✗ | AWS and GCP rotation, dynamic on Enterprise | Nothing in the cloud | | Bitwarden Secrets Manager | Small teams that mostly store static secrets | Cloud, self-hosted on Enterprise | Partly (AGPL core) | ✗ | Little in the cloud |
## 1. Infisical Infisical is an open-source secrets manager that holds secrets for AWS, other clouds, third-party services, and on-premises systems. It obviates Lambda functions and other “glue” by automating secret rotations and app connections. Infisical works directly with AWS Secrets Manager by syncing secrets into Secrets Manager and Parameter Store where AWS services expect them, so teams adopting Infisical don’t need to change the configuration of consuming services. It runs in Infisical Cloud or self-hosted, including air-gapped, with an MIT-licensed core. **Best for:** teams who need to manage secrets on AWS and beyond who want one place to manage them without building rotation functions and centralized observability over secrets management and rotation patterns. **Strengths:** - A dashboard where developers organize secrets in folders, reference one secret from another, and change values without a ticket. - [Rotation](https://infisical.com/docs/documentation/platform/secret-rotation/overview) for 30+ targets, including PostgreSQL, MySQL, MSSQL, Oracle, MongoDB, Redis, LDAP, AWS IAM, Azure and GCP credentials, Okta, Stripe, and OpenAI, with no function to write for any of them. - [Dynamic secrets](https://infisical.com/blog/secret-rotation-vs-dynamic-secrets) for 30+ targets, including databases, [AWS IAM](https://infisical.com/docs/documentation/platform/dynamic-secrets/aws-iam), GCP IAM, Azure Entra ID, Kubernetes, and SSH, so a workload can get a credential that expires on its own. - Syncs into 50+ destinations, including AWS Secrets Manager, Parameter Store, Azure Key Vault, GCP Secret Manager, GitHub, GitLab, and Vercel, plus a [Kubernetes operator](https://infisical.com/blog/kubernetes-secrets-management), CSI driver, and injector. - Approval policies on changes to production, access requests, temporary access, and point-in-time recovery for every environment. - Workloads on AWS authenticate with their IAM role through AWS Auth, the same way they reach Secrets Manager today. - [Certificate management](https://infisical.com/blog/certificate-management), privileged access, and KMS on the same platform, so the secrets, certificates, and keys a team manages sit in one place. **How it improves on AWS Secrets Manager:** - One project holds the secrets for AWS, the other clouds, on-premises, and CI/CD, organized by environment rather than by naming convention or account boundary. - The [AWS Secrets Manager sync](https://infisical.com/docs/integrations/secret-syncs/aws-secrets-manager) pushes values from Infisical into Secrets Manager in the Regions you choose, so Lambda, ECS, and the other AWS services that read from it keep working unchanged. - Rotation and dynamic secrets are built in for the targets above, so the Lambda rotation functions can be retired one secret type at a time. **Pricing model:** a free tier and paid plans in the cloud, and a free open-source core when self-hosted, with an enterprise license for advanced features. ## 2. AWS Systems Manager Parameter Store Parameter Store is the configuration store inside AWS Systems Manager. It holds plain strings, string lists, and SecureString parameters encrypted with AWS KMS. AWS states that Parameter Store is ideal for anything you don’t need to rotate. **Best for:** AWS teams that need a hierarchical store for configuration and a few low-risk secrets, and want to stop paying per secret for values that never rotate. **Strengths:** - Standard parameters cost nothing. - Path hierarchies such as `/prod/payments/db-host`, with IAM policies scoped to a path. - 100 versions per parameter. - Lambda, ECS, CloudFormation, and CodeBuild read from it directly. **Limitations:** - It has no rotation, so a credential that needs rotating goes back to Secrets Manager or to something that rotates it. - Standard parameters are capped at 10,000 per Region and 4 KB each. Advanced parameters raise both and are billed per parameter. - Default throughput is 40 reads per second across the Get calls, and higher throughput is billed, so busy deployments need caching and retries. - ECS reads values when a task starts, so a changed value needs a redeploy. **Pricing model:** standard parameters free. Advanced parameters per parameter per month, and higher throughput per 10,000 interactions. ## 3. HashiCorp Vault Vault is HashiCorp's [secrets and encryption management system](https://infisical.com/blog/hashicorp-vault-secrets-management), self-hosted or managed. HashiCorp moved Vault to the Business Source License in 2023, and has been part of IBM since 2025. Vault is a powerful secrets management product that supports most workflows that exist, but users often complain about its complexity. Vault is a set of services you assemble (and that often requires custom engineers with specialized knowledge), not a product that works out of the box, which means it’s best for organizations willing to build a dedicated team. **Best for:** platform and security teams with the people to run a central secrets and encryption service and who don’t mind manually wiring it up. **Strengths:** - Covers many types of credentials. - Dynamic database and AWS IAM credentials with leases and revocation. - Encryption as a service through the transit engine. - Three paths into Kubernetes: the Vault Secrets Operator, a CSI provider, and the Agent Injector. **Limitations:** - Self-managed Vault is a cluster to run: unsealing, storage, high availability, and upgrades, and it needs people who know it. HCP Vault Dedicated moves that work to HashiCorp for an hourly fee. - Syncing secrets into AWS Secrets Manager and other stores, approvals on access, and namespaces are Vault Enterprise only. - There's no environment concept. Structure comes from mounts, paths, and policies that each team designs. - The Community Edition’s Business Source License isn't an open-source license. - Some customers have complained about slow support and price increases after the IBM acquisition. **Pricing model:** Vault Community is free under the BSL. Enterprise is licensed through sales, and HCP Vault Dedicated bills an hourly cluster fee plus a per-client fee on some tiers. ## 4. OpenBao OpenBao is a community-governed fork of Vault, started after the 2023 license change and run under the Linux Foundation as an OpenSSF Sandbox project. It keeps Vault's API and model under the MPL-2.0 license. Because of its lineage, it offers many of the same ergonomics of Vault. This means it’s ideal for teams with Vault experience. As a pure open-source project, OpenBao offers no vendor support. This makes it ideal for teams who don’t mind building out functionality themselves. **Best for:** teams that want Vault's model under an open-source license and open governance, and that run their own infrastructure. **Strengths:** - MPL-2.0, with a technical steering committee rather than a single vendor. - Namespaces and control groups (approvals) ship in the open-source project. - Vault-compatible engines for KV, databases, PKI with ACME, SSH, transit, Kubernetes, and LDAP. **Limitations:** - OpenBao removed Vault's AWS, Azure, and GCP secrets engines and cloud IAM auth methods from the core part of the product. They still exist in the repo. - Its database engines cover Cassandra, InfluxDB, MySQL and MariaDB, PostgreSQL, and Valkey. - It keeps Vault's operating model, so the cluster, the unsealing, and the people who know them all stay. - There's no managed offering, no vendor support contract, and no sync to other secret stores. The project is maintained by a small group who monetize the project in competing ways. **Pricing model:** free. ## 5. Doppler Doppler is a [hosted secrets and configuration platform](https://infisical.com/blog/doppler-alternatives) for application teams, with a dashboard, CLI, and syncs into cloud, CI/CD, and hosting platforms. **Best for:** product teams that want a hosted, developer-friendly home for environment variables and config. **Strengths:** - A clear model of projects, environments, and configs, with inheritance between them. - A broad catalog of syncs into clouds, CI/CD, and hosting platforms. - Version history with rollback, per-secret access logs, and change requests. - A Kubernetes operator. **Limitations:** - It's closed source. Self-hosting is Enterprise only. - Documented rotation covers AWS targets and GCP service account keys. Dynamic secrets are Enterprise only, for AWS IAM and Azure service principals. - There's no certificate management or privileged access. **Pricing model:** per user per month, with add-ons per seat. ## 6. Bitwarden Secrets Manager Bitwarden Secrets Manager is the developer secrets product from Bitwarden, separate from its password manager, with projects, machine accounts, and access tokens used through the `bws` CLI and SDKs. Teams leaving Secrets Manager over a growing per-secret bill, with mostly static secrets, sometimes land here. **Best for:** small teams whose secrets are mostly static and who want an end-to-end encrypted store that isn't tied to one cloud. **Strengths:** - Priced per user with a free tier, rather than per secret. - End-to-end encrypted, with a zero-knowledge design. - Works the same from AWS, other clouds, and CI, with integrations for GitHub Actions, GitLab, and Terraform. - Self-hosting on the Enterprise plan. **Limitations:** - No documented rotation of any kind, so the RDS and Aurora rotation Secrets Manager handles today would become scripts. - No sync into Secrets Manager or other cloud stores, so AWS services that read secrets natively need a fetch step. - Each secret belongs to one project, with no environments. - History is a 30-day trash rather than versions to roll back to. **Pricing model:** per user, plus machine accounts beyond the plan's allowance. ## Moving off AWS Secrets Manager Most teams move one environment at a time. In Infisical, connect your AWS account and add an AWS Secrets Manager sync with an initial behavior that imports the existing secrets, giving Secrets Manager's values priority. Infisical pulls in what's already there, then keeps Secrets Manager filled from then on, so nothing that reads from it changes while you move applications to read from Infisical directly, or leave them on the sync. The [Secrets Manager vs. Parameter Store comparison](https://infisical.com/blog/aws-secrets-manager-vs-parameter-store) covers the in-AWS option in more depth, and the [best secrets management tools](https://infisical.com/blog/best-secret-management-tools) cover the wider field. ## FAQ ### What are some alternatives to AWS Secrets Manager? The main alternatives to AWS Secrets Manager are more full-featured secrets managers like Infisical. Infisical fits teams whose secrets span more than AWS because it integrates directly with AWS, GCP, Azure, and many other providers, including third-party services and on-premises infrastructure. ### How is AWS Secrets Manager priced? AWS Secrets Manager [charges per secret per month](https://infisical.com/blog/secrets-manager-pricing) and per API call, and each cross-Region replica is billed as its own secret. The total depends mostly on how many secrets you store across environments, accounts, and Regions, and on how often applications read them without caching. ### Is there a free secret manager? Yes. Infisical's open-source core is free to self-host, and Infisical Cloud has a free tier. OpenBao is free and open source. ### What is the difference between AWS Secrets Manager and Parameter Store? Secrets Manager is built for credentials, with rotation, cross-Region replication, and per-secret pricing. Parameter Store is a configuration store with free standard parameters, path hierarchies, and no rotation. Many teams use both: Parameter Store for configuration, and Secrets Manager for the credentials that rotate. ### Is AWS KMS the same as Secrets Manager? No. AWS KMS creates and manages encryption keys and performs cryptographic operations with them, while Secrets Manager stores secrets such as database passwords and API keys and uses KMS to encrypt them. The [Secrets Manager vs. KMS breakdown](https://infisical.com/blog/aws-secrets-manager-vs-kms) covers where each one fits. To manage your secrets across AWS and everything else in one place, [sign up](https://app.infisical.com/signup) and import your first secrets today, or [talk to an expert](https://infisical.com/talk-to-us) about your setup.
/blog/aws-secrets-manager-alternatives.md · raw source