Infisical vs. AWS Secrets Manager
AWS Secrets Manager only manages secrets on AWS and rotations require Lambda functions. Infisical manages secrets in one place for any cloud, automatically rotates them, and can sync into Secrets Manager.
The Secrets Manager way
Work on AWS only and maintain rotations yourself.
- Store a new secret
- laptop
- Edit rotation
- Edit inbound rules
- orders-db-rotation: setSecret: Unable to log into database
- laptop
- Why did my Secrets Manager Lambda function rotation fail with a "pg module not found" error?
- Lambda runtime end of support: Recreate the rotation functions still on the old runtime.
- Prod secret access for the data team: Waiting on a resource policy and a key policy
- Sam, data team: Our GCP jobs need the Stripe key too. Do we copy it over by hand?
The Infisical way
Secrets for every environment in one place.
What's the difference between Infisical and AWS Secrets Manager?
Secrets Manager stores secrets for AWS. Infisical automates secrets management across AWS accounts, other clouds, and on-prem.
Deploy/integrate
Infisical- Use managed cloud, or self-host on Docker, Kubernetes, Linux, AWS ECS, or Google GKE
- Sync into Secrets Manager in every account and Region you use
AWS Secrets Manager- Design a naming scheme and account layout for each environment
Migrate/onboard
Infisical- Import secrets from Secrets Manager
- Add secrets from .env files or other stores
AWS Secrets Manager- Write IAM policies for each new app's role in every account it reads from
Control access
Infisical- Scope roles to projects, environments, and folders
- Define secret change approval policies
AWS Secrets Manager- Pair a resource policy with a KMS key policy
- No approval before a secret changes
Operate
Infisical- See all secrets, projects, and environments in one dashboard
- Run apps locally with secrets injected by the CLI
AWS Secrets Manager- Switch accounts and regions in the console to find a secret
- Manually move version labels with the CLI to roll back
Automate
Infisical- Rotate database passwords, AWS IAM access keys, and SaaS API keys out of the box
- Sync secrets to 52+ destinations, Secrets Manager included
AWS Secrets Manager- Maintain rotation functions for every secret beyond AWS databases and partner keys
- Script copies to other clouds and CI yourself
Scale
Infisical- Give workloads on GCP, Azure, Kubernetes, or on-prem their own identities
- Manage certificates, privileged access, KMS, and AI agent access in the same platform
AWS Secrets Manager- Set up IAM Roles Anywhere or OIDC federation for every workload outside AWS
Infisical vs. AWS Secrets Manager at a glance
Secrets Manager holds secrets for AWS services. Infisical manages secrets on AWS and beyond it for any team or environment.
| Feature |  | AWS Secrets Manager |
|---|---|---|
| Open sourceWhether the source code is public and auditable for your team. | MIT-licensed, 30,000+ GitHub stars | |
| Self-hostingRunning the product in your dedicated cloud or on-premises infrastructure. | Docker, Kubernetes, Linux, AWS ECS, or Google GKE | AWS only |
| Managed cloudA version the vendor hosts and operates for you. | US and EU regions | |
| Product scopeWhat Infisical and AWS Secrets Manager cover beyond secrets management. | Secrets, certificates, privileged access, AI agents, and KMS | Secrets only |
| Secret structureHow secrets are organized. | Projects with environments, folders, and references | Named secrets per account and Region, no environments |
| Secret rotationRevoking the old credential and issuing a new, valid one (on a schedule or on demand). | Built in for dozens of credentials | Only for AWS databases and select partners |
| Dynamic secretsShort-lived credentials created on demand and revoked automatically when they expire. | AWS IAM, databases, Kubernetes, and more | |
| Syncs and integrationsPushing secrets wherever apps run e.g. cloud secret stores and CI/CD. | 52+ destinations, Secrets Manager included | Replicas to other Regions, nothing outside AWS |
| KubernetesDelivering secrets into workloads running on Kubernetes. | Operator, CSI provider, or agent injector | CSI provider |
| Access controlRules for who can see things or make changes. | Roles scoped to environments and folders, plus ABAC | IAM policies |
| Workload authenticationHow apps and pipelines prove their identity. | Native AWS, GCP, Azure, Kubernetes, OIDC, and SPIFFE identities | IAM only, federated or certificate-based outside AWS |
| Approval workflowsRequiring sign-off for sensitive changes or access. | ||
| SAML SSOSigning in through an identity provider like Okta or Microsoft Entra ID. | Through IAM Identity Center | |
| SCIMCreating and removing user accounts via your identity provider. | Through IAM Identity Center | |
| Audit log retentionHow long audit logs are kept and where. | Searchable, and streams to SIEMs like Splunk, Datadog, and others | CloudTrail, 90 days unless you create a trail |
| Agent security productWhether the vendor has a dedicated product built to secure AI agents. | Agent Vault, plus agent access in PAM | AgentCore Identity in Bedrock |
| Credentials kept from the agentWhether an agent holds plaintext credentials or not. | Agent never sees any secret | |
| Agent access to infrastructureHow agents reach sensitive infrastructure. | Databases, servers, and clusters, with approvals and session recording | IAM roles on the agent's identity |
Use AWS Secrets Manager and Infisical together
Keep AWS Secrets Manager for AWS workloads, but use Infisical to manage secrets.
Secrets sync in
Manage secrets in Infisical, but sync into Secrets Manager so Lambda, ECS, and EKS keep reading as they used to.
Frequently asked questions
Everything you need to know. Can't find an answer? Talk to our team.
AWS Secrets Manager charges per secret per month and per 10,000 API calls. Each replica in another Region is billed as its own secret. Rotation functions add Lambda charges, and secrets shared across accounts need another billable item: customer-managed KMS keys. The larger cost is usually the work around it: the rotation functions, cross-account policies, and copy scripts a team writes and maintains. Infisical rotates and syncs secrets out of the box and has a free tier.
On AWS, you can use both. AWS services read secrets from Secrets Manager, and Infisical syncs into it. This combines the native connection between Secrets Manager and AWS services with the upsides of Infisical: automated rotation, self-hosting, and multi-cloud functionality.
Secrets Manager rotates RDS, Aurora, DocumentDB, and Redshift admin credentials and some partner keys. Everything else requires writing, deploying, and maintaining a Lambda function. Infisical automatically syncs updated values from rotations into Secrets Manager.
Secrets Manager stores named secrets per account and region, so environment separation requires naming conventions, tags, IAM policies, or separate accounts. Infisical keeps each app in one project.
Yes, but it requires a resource policy on the secret, an identity policy in the other account, and a customer managed KMS key. Infisical keeps each secret in one place and syncs it into Secrets Manager in any account and Region.
Yes, but it's complex: Workloads outside AWS require IAM Roles Anywhere, with certificates from your own CA, or OIDC federation. Secrets Manager doesn't sync to other clouds or CI/CD platforms. Infisical authenticates AWS, GCP, Azure, Kubernetes, and OIDC workloads natively and syncs secrets to 52+ destinations, Secrets Manager included.
Amazon Bedrock offers AgentCore Identity, which lets agents see plaintext secrets. Infisical Agent Vault uses a credential brokering approach to give agents access to services without holding credentials. For databases, servers, and clusters, Infisical PAM gives agents the same roles, approvals, and session recording as people.
How to migrate from AWS Secrets Manager to Infisical
Most teams keep Secrets Manager in place for AWS and move secret management to Infisical one app at a time.
- 01
Connect AWS
Add an AWS connection in Infisical for each account, through an IAM role Infisical assumes.
- 02
Import one app
Create a Secrets Manager sync for a first, non-critical app and import the secrets it already holds.
- 03
Manage it in Infisical
Edit and rotate the app's secrets in Infisical. The sync keeps Secrets Manager current, so the app doesn't change.
- 04
Repeat for every app
Bring the other apps over the same way and retire their rotation functions. Workloads outside AWS read from Infisical directly.
Our team can help you plan and run the migration.
Start managing secrets, then add certificates, privileged access, KMS, or agent access.
Add products when you need them, on the platform you already run.
- OpenAI: API, Codex
- Let's Encrypt
- Vercel
- Gemini CLI
- Apache Airflow
- Spring Boot
- OpenCode
- DigiCert
- Jenkins
- Terraform: Terraform, Terraform Cloud
- Render
- Azure: Key Vault, App Configuration, DevOps, Entra ID, CLI
- NetScaler
- Databricks
- KMIP
- GoDaddy
- Pulumi
- Okta
- Ansible
- Cloudflare: Workers, Pages, Custom certificates
- Sectigo
- Laravel
- Hermes
- SAP HANA
- ClickHouse
- OpenRouter
- Supabase
- Docker
- Snowflake
- Venafi
- Rails
- Humanitec
- Tailscale
- 1Password
- OpenClaw
- Cassandra
- Northflank
- Redis
- Datadog
- Google Cloud: Secret Manager, Certificate Manager, IAM, KMS
- Dell PowerEdge
- Bitbucket
- Claude Code
- Railway
- dbt Cloud
- Windows Server
- Chef
- .NET
- PostgreSQL
- AWS: Secrets Manager, Parameter Store, Certificate Manager, Elastic Load Balancing, Private CA, IAM, KMS, CloudHSM, ECS, Amplify
- Linux servers
- Auth0
- Oracle: Oracle Database, OCI Vault
- Octopus Deploy
- Fly.io
- MySQL
- F5 BIG-IP
- LDAP
- TeamCity
- Qovery
- Nutanix Prism Central
- Microsoft: Active Directory, AD CS
- Windmill
- LiteLLM
- Netlify
- RabbitMQ
- Spacelift
- Kubernetes
- CircleCI
- GitLab
- SQL Server
- Stripe
- DigitalOcean
- GitHub: GitHub, GitHub Actions
- Couchbase
- MongoDB: MongoDB, MongoDB Atlas
- Heroku
- SSH
- Salesforce
- HashiCorp Vault
- Travis CI
- Kemp LoadMaster
- Next.js
- Django
- Sigstore Cosign
- Elasticsearch
- Secrets ManagementToday
- Certificate ManagementWhen you need it
- Privileged Access ManagementWhen you need it
- KMSWhen you need it
- Agent VaultWhen you need it
Talk to our team
Starting with Infisical is simple, fast, and free.
- Secures 10 billion secrets every day
- SOC 2, HIPAA, and FIPS 140-3 compliant
- Open source, in our cloud or yours
Talk to your boss
Need a yes from your boss?
Here's a message to send your manager. Edit it, then paste it into Slack, Teams, or an email.
Trusted by teams at
