starter.wiki

AWS-native managed secrets service

AWS Secrets Manager

A managed AWS service for storing, retrieving, versioning, monitoring, and integrating rotation of secrets under AWS identity and service boundaries.

Visit official site

Editorial verdict

Choose AWS Secrets Manager for AWS-centered workloads when IAM and service integration reduce more work than the regional, API, rotation, and cloud-specific operating boundary adds.12

Best for

  • AWS-native workload identity
  • Managed secret versions and retrieval
  • AWS services using rotation integrations
12

Not ideal for

  • Vendor-neutral cross-platform control planes
  • Local-first or multi-cloud estates
  • Teams that have not modeled API, secret, rotation, KMS, and replication costs
12
Main trade-off

AWS alignment reduces integration work while stored secrets, API calls, rotation functions, KMS, regions, replication, and migration remain cloud-specific.12

Product boundary

Whether AWS-native identity, versions, rotation integration, and service placement outweigh multi-cloud portability and metered use.

AWS Secrets Manager stores secret values and versions and integrates access, monitoring, replication, and rotation within AWS. It does not rotate every target by itself, replace IAM design, or remove Lambda, KMS, network, region, recovery, and application availability decisions.12

For: Teams whose protected workloads, identities, and operational controls already live primarily in AWS

  • Protected workloads are no longer AWS-centered
  • A cross-platform control plane becomes necessary
  • Rotation, KMS, regional, API, or migration cost changes the fit

Why teams consider AWS Secrets Manager

  • AWS identity integrationIAM policies govern access from users and workloads.12
  • Managed secret lifecycle primitivesThe service provides versions, retrieval, monitoring, and documented rotation patterns.12
  • Service placementSupported AWS services can consume secrets inside an AWS-centered architecture.12

Pricing

AWS meters stored secrets and API calls; rotation functions, customer-managed KMS keys, logging, replication, networking, and adjacent AWS services can add separate charges.2

Current decision boundary

Usage-based AWS service

Verified 2026-07-27: AWS Secrets Manager has no setup fee and bills for stored secrets and API use; rotation Lambda, customer-managed KMS keys, regions, replication, and other services remain separate.2

Primary meters
Stored secrets and API calls2
Rotation boundary
Lambda and target-system work can add cost and ownership2
Cloud boundary
KMS, regions, replication, logs, networking, and migration2
Pricing checked View official pricing

AWS Secrets Manager vs alternatives

Doppler

Choose when
Cross-platform application configuration
Avoid when
One small hosting-platform boundary
Compared with AWS Secrets Manager
Centralization reduces configuration drift while adding a networked control plane, service availability, per-seat pricing, integration behavior, and migration dependency.34

Infisical

Choose when
Cloud or self-hosted secrets management
Avoid when
Teams unable to operate a self-hosted security control plane
Compared with AWS Secrets Manager
Deployment choice increases control while making edition boundaries and self-hosted encryption, storage, backups, upgrades, availability, and identity explicit responsibilities.56

HashiCorp Vault

Choose when
Dynamic credentials and leases
Avoid when
Small teams with simple static secrets
Compared with AWS Secrets Manager
Vault can support advanced control models while transferring a substantial availability, storage, identity, policy, upgrade, recovery, monitoring, and licensing burden to the organization.78

Resources and sources

Official product, pricing, policy, and operating sources

  • AWS Secrets Manager introduction
    Open
  • AWS Secrets Manager pricing
    Open
  • Doppler documentation
    Open
  • Doppler pricing
    Open
  • Infisical introduction
    Open
  • Infisical pricing
    Open
  • What is Vault?
    Open
  • HashiCorp consumption pricing
    Open
  1. 1
    AWS Secrets Manager introduction

    AWS · Accessed Official

  2. 2
    AWS Secrets Manager pricing

    AWS · Accessed Official

  3. 3
    Doppler documentation

    Doppler · Accessed Official

  4. 4
    Doppler pricing

    Doppler · Accessed Official

  5. 5
    Infisical introduction

    Infisical · Accessed Official

  6. 6
    Infisical pricing

    Infisical · Accessed Official

  7. 7
    What is Vault?

    HashiCorp · Accessed Official

  8. 8
    HashiCorp consumption pricing

    HashiCorp · Accessed Official