Every engineering team running production infrastructure eventually hits the same wall: credentials, API keys, database passwords, and TLS certificates scattered across config files, CI/CD variables, and Slack messages. Secrets management tools exist to fix that, and three names dominate the conversation in August 2026: HashiCorp Vault, AWS Secrets Manager, and Azure Key Vault. Each takes a different approach to the same problem, and each charges for it differently.
The comparison got more interesting this year. HashiCorp shipped Vault 2.0 in April 2026, its first major version jump in a decade, while parent company IBM folded the product into its compliance branding after closing the HashiCorp acquisition. Microsoft, meanwhile, disclosed a maximum-severity elevation-of-privilege flaw in Azure Key Vault in July 2026. AWS Secrets Manager stayed quiet on the news front but kept its usage-based pricing model unchanged. This guide compares all three on pricing, security certifications, dynamic secrets, multi-cloud support, and real deployment scenarios, so you can pick the right one before your next audit or your next cloud bill.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
HashiCorp Vault vs AWS Secrets Manager vs Azure Key Vault at a Glance
Before the deep dive, here is the short version. AWS Secrets Manager and Azure Key Vault are fully managed, cloud-native services that only make sense if you already live inside their respective clouds. HashiCorp Vault is a standalone secrets management platform that runs anywhere, self-hosted or through HashiCorp’s managed HCP Vault Dedicated offering, and it is the only one of the three built to broker secrets across multiple clouds from a single control plane.
Cost follows the same split. Azure Key Vault charges $0.03 per 10,000 operations with no storage fee. AWS Secrets Manager charges $0.40 per secret per month plus $0.05 per 10,000 API calls. HashiCorp Vault Community Edition is free to self-host, but the managed HCP Vault Dedicated tier starts around $450 a month for a development cluster and climbs past $1,150 a month plus per-client fees for production. Run the math on a single secret pulled 10,000 times a month and Azure comes out to roughly $0.03 against AWS’s $0.45, a gap of about 15x on that specific workload. Scale, usage pattern, and compliance requirements change that math fast, which is the whole point of this comparison.
What Each Platform Actually Does
All three tools solve the same core problem: store sensitive values encrypted, control who can read them, and rotate them without a human copying a password into a text file. How they get there differs enough that picking the wrong one creates real operational pain later.
HashiCorp Vault: Open Core With Enterprise and Managed Tiers
Vault started as an open-source project and still ships a free Community Edition under HashiCorp’s Business Source License, meaning you can self-host it on any infrastructure, including on-premises hardware, at no license cost. HashiCorp shipped Vault 2.0.0 on April 14, 2026, its first major-version release since the long-running 1.x line, with patch releases following through 2.0.1 (May 19), 2.0.3 (June 17), and 2.0.4 (August 4, 2026), according to HashiCorp’s own release notes. The 1.21.x branch remains available as the final long-term-support release on the old numbering scheme, per endoflife.date’s Vault lifecycle tracker.
Above Community Edition sits Vault Enterprise, a self-hosted, contract-priced product aimed at regulated industries that need FIPS 140-3 cryptography, HSM integration, and multi-datacenter replication. HashiCorp also runs a managed cloud version, HCP Vault Dedicated, which took over the role previously held by the now-retired HCP Vault Secrets product. HashiCorp confirmed HCP Vault Secrets reached end of sale on June 30, 2025, and end of life on July 1, 2026, folding its free and standard tiers into renamed HCP Vault Dedicated Development and Essentials plans.
AWS Secrets Manager: Native, Serverless, AWS-Only
AWS Secrets Manager is a fully managed service with no clusters to run and no version numbers to track. You store a secret, tag it, attach a rotation Lambda function if you want automatic rotation, and AWS handles availability across the region. It integrates natively with IAM, so permissions live in the same policy language you already use for every other AWS resource. The tradeoff is portability: Secrets Manager only runs inside AWS, and there is no realistic path to using it as a secrets broker for a different cloud provider.
Azure Key Vault: Keys, Secrets, and Certificates in One Vault
Azure Key Vault covers three object types in a single service: secrets (arbitrary strings like connection strings), keys (cryptographic keys for signing and encryption), and certificates (TLS certs with automated renewal). It ships in Standard and Premium tiers, with Premium adding hardware security module (HSM) backing for keys. Microsoft also sells a separate Managed HSM product for teams that need a dedicated, single-tenant HSM cluster rather than the shared model used by Premium keys, according to Microsoft’s key management pricing documentation.
Feature and Specs Comparison Table
The table below lines up the specs that matter most when picking a secrets platform for a production workload.
| Category | HashiCorp Vault | AWS Secrets Manager | Azure Key Vault |
|---|---|---|---|
| Deployment model | Self-hosted or HCP Vault Dedicated (managed) | Fully managed, serverless | Fully managed, serverless |
| Current version (Aug 2026) | Vault 2.0.4 (Aug 4, 2026) | N/A, continuously updated service | N/A, continuously updated service |
| Free / open-source tier | Community Edition, self-hosted | $200 free credit for new AWS customers | No free tier, pay-per-operation from first use |
| Multi-cloud support | Yes, cloud-agnostic by design | AWS only | Azure only |
| Dynamic secrets (auto-generated, short-lived credentials) | Yes, native dynamic secrets engines for databases, cloud IAM, PKI | Rotation via Lambda functions, not true dynamic issuance | Rotation policies for secrets, not dynamic credential generation |
| Automated rotation | Built-in for supported engines | Native rotation with AWS-provided or custom Lambda templates | Native rotation policies with Event Grid triggers |
| Object types stored | Secrets, dynamic credentials, encryption keys, certificates | Secrets only | Secrets, keys, and certificates |
| Kubernetes integration | Vault Agent Injector, CSI provider | External Secrets Operator, Secrets Store CSI Driver | External Secrets Operator, Secrets Store CSI Driver |
| FIPS 140-3 validation | Vault Enterprise 1.19.4+ with FIPS enabled is Leidos-attested conformant | Not explicitly stated as a service-level FIPS certification | Premium tier is FIPS 140-3 Level 3 validated for HSM-backed keys |
| PCI DSS compliance | HCP Vault Dedicated compliant with PCI DSS v4.0.1 | PCI DSS v3.2 Attestation of Compliance, Service Provider Level 1 | Premium tier is PCI-compliant |
| HIPAA eligibility | Depends on self-hosted environment configuration | HIPAA-eligible service | HIPAA-eligible per Microsoft compliance documentation |
| HSM-backed keys | Supported via external HSM/PKCS11 integration | Uses AWS KMS, no direct HSM-backed secret storage | Native, Premium tier and dedicated Managed HSM |
| Native IAM integration | Own policy engine plus cloud auth methods (AWS IAM, Azure AD, GCP IAM) | AWS IAM natively | Microsoft Entra ID natively |
| Pricing model | Free self-hosted, or cluster + per-client fees on HCP | Per-secret storage fee + per-API-call fee | Per-10,000-operations fee, plus per-key fees on Premium |
Pricing Compared: What Each Platform Actually Charges
Pricing is where the three products diverge hardest, because each uses a fundamentally different billing unit. AWS charges by the secret and by the API call. Azure charges purely by the operation, with no storage fee at all. HashiCorp charges nothing for the software if you self-host, but its managed tier bills by cluster size plus a per-client fee that adds up fast in larger environments.
| Platform | Tier | Price | Notes |
|---|---|---|---|
| HashiCorp Vault | Community Edition | Free | Self-hosted, BSL license, you pay for infrastructure and ops time |
| HashiCorp Vault | HCP Vault Dedicated, Development | ~$450/month | Extra-small non-production cluster |
| HashiCorp Vault | HCP Vault Dedicated, Essentials | ~$1,152/month + $72.92/client/month | Small production cluster, 99.9% SLA |
| HashiCorp Vault | HCP Vault Dedicated, Standard | ~$1,345/month + $72.92/client/month | Requires two clusters for multi-datacenter replication |
| HashiCorp Vault | Vault Enterprise (self-hosted) | Custom quote | No public price list, negotiated by client count and modules |
| AWS Secrets Manager | Standard usage | $0.40/secret/month + $0.05/10,000 API calls | $200 free credit for new AWS customers since July 15, 2025 |
| Azure Key Vault | Standard, secret operations | $0.03 per 10,000 operations | No per-secret storage fee |
| Azure Key Vault | Certificate renewal | $3.00 per renewal request | Applies regardless of tier |
| Azure Key Vault | Premium, HSM-backed RSA 2048-bit key | $1.00/key/month + $0.03/10,000 transactions | Hardware-backed, shared HSM pool |
| Azure Key Vault | Premium, HSM-backed RSA 3072/4096-bit or EC key | $5.00/key/month + transaction fees | Advanced HSM key types |
| Azure Managed HSM | Standard B1 cluster | Roughly $3.20 to $4.80/hour (~$2,300 to $3,650/month) | Dedicated single-tenant HSM cluster, billed per cluster not per key |
Run a simple side-by-side: one secret retrieved 10,000 times in a month. AWS Secrets Manager bills $0.40 for storage plus $0.05 for the API calls, landing at $0.45. Azure Key Vault, with no storage fee, bills just $0.03 for those same 10,000 operations, a roughly 15x gap on that specific unit of work. Scale that to a fleet of 500 secrets with heavy API traffic and the totals shift again, since AWS’s flat per-secret fee starts to dominate while Azure’s usage-based model rewards low-secret-count, high-traffic architectures. HashiCorp Vault’s self-hosted Community Edition undercuts both at zero license cost, but only if your team can absorb the operational overhead of running, unsealing, and patching a Vault cluster yourself.
Real-World Cost Scenarios: Three Workloads Modeled
List prices only tell part of the story, since actual monthly bills depend on secret count, traffic, and whether you need a managed cluster at all. The table below models three common team sizes against each platform’s published rates, using moderate assumptions for API traffic and secret counts at each scale.
| Workload | HashiCorp Vault | AWS Secrets Manager | Azure Key Vault |
|---|---|---|---|
| Small team, 20 secrets, light traffic | $0 (self-hosted Community) or ~$450/mo (HCP dev tier) | ~$10.50/mo (20 secrets + moderate API calls) | Under $2/mo (usage-based, no storage fee) |
| Mid-size app, 100 secrets, moderate traffic | ~$1,152/mo + per-client fees (HCP Essentials) | ~$45/mo (100 secrets + API traffic) | Under $10/mo for Standard tier operations |
| Enterprise, multi-cloud, 500+ secrets, HA required | ~$1,345/mo + per-client fees (HCP Standard, dual-cluster) or custom Vault Enterprise quote | $200+/mo storage alone, plus API and cross-region replication costs | Premium tier plus HSM key fees, often $500-$2,000+/mo depending on key count |
The pattern holds across all three scenarios: Azure Key Vault stays cheapest at low-to-moderate scale because it has no storage fee, AWS Secrets Manager’s flat per-secret charge scales predictably but climbs faster than Azure’s usage-based model, and HashiCorp Vault is either free (self-hosted, unmanaged) or the most expensive option once you pay for HCP Vault Dedicated’s cluster and per-client fees at production scale.
Security and Compliance Certifications
For regulated teams, the compliance column often matters more than the price column. All three platforms carry serious certifications, but the specifics differ by tier.
HashiCorp confirms that Vault Enterprise 1.19.4 and later, with FIPS mode enabled, has Leidos attestation of FIPS 140-3 conformance. HCP Vault Dedicated, along with the rest of HashiCorp’s cloud product line under IBM, is listed as compliant with PCI DSS v4.0.1. AWS Secrets Manager holds a HIPAA-eligible status and a PCI DSS v3.2 Attestation of Compliance at Service Provider Level 1, per AWS’s own compliance documentation. Azure Key Vault’s Premium tier is FIPS 140-3 Level 3 validated for HSM-backed keys and is PCI-compliant, according to Microsoft’s key management pricing page, with HIPAA eligibility documented separately in Microsoft’s compliance offerings.
The practical takeaway: if an auditor specifically requires FIPS 140-3 Level 3 validation on hardware-backed keys, Azure Key Vault Premium and Vault Enterprise with an external HSM both clear that bar, while AWS Secrets Manager’s documentation does not make an equivalent service-level FIPS claim for the secrets store itself. Teams under PCI DSS scope have a clean path on all three, provided they pick the correct tier.
| Certification | HashiCorp Vault | AWS Secrets Manager | Azure Key Vault |
|---|---|---|---|
| FIPS 140-3 | Yes, Vault Enterprise 1.19.4+ with FIPS mode, Leidos-attested | Not explicitly stated at service level | Yes, Premium tier, Level 3, for HSM-backed keys |
| PCI DSS | v4.0.1, HCP Vault Dedicated and related IBM HashiCorp products | v3.2 Attestation of Compliance, Service Provider Level 1 | Premium tier is PCI-compliant |
| HIPAA | Depends on self-hosted configuration, not a blanket certification | HIPAA-eligible service | HIPAA-eligible per Microsoft documentation |
| SOC 2 | Covered under IBM HashiCorp’s cloud compliance program for HCP products | Covered under AWS’s broader SOC 2 attestation | Covered under Microsoft Azure’s broader SOC 2 attestation |
Dynamic Secrets and Automated Rotation
This is the single biggest architectural difference between Vault and the two cloud-native services. Vault’s dynamic secrets engines generate short-lived, unique credentials on demand for a database, a cloud IAM role, or a PKI certificate, then automatically revoke them when the lease expires. No human or application ever sees a long-lived password, because one never gets created in the first place.
# Enable a dynamic database secrets engine in Vault
vault secrets enable database
vault write database/config/production-postgres \
plugin_name=postgresql-database-plugin \
connection_url="postgresql://{{username}}:{{password}}@db.internal:5432/app" \
allowed_roles="readonly-app"
# Request a short-lived credential, valid for 1 hour
vault read database/creds/readonly-appAWS Secrets Manager and Azure Key Vault both handle rotation, but the mechanism is different: you store a static secret and attach a rotation function or policy that periodically changes the underlying credential and updates the stored value. That is real automated rotation, and it closes most of the same risk window, but the secret itself still exists as a stored, retrievable value between rotations rather than being generated fresh for every consumer. For teams whose compliance framework specifically calls out “ephemeral credentials” or “just-in-time access,” Vault’s dynamic secrets model is the more direct fit.
Multi-Cloud and Kubernetes Support
Vault’s biggest structural advantage is that it does not care which cloud it runs on, or which cloud it manages secrets for. A single Vault cluster can authenticate against AWS IAM, Azure AD, and Google Cloud IAM simultaneously, making it the natural choice for platform teams running genuinely multi-cloud or hybrid environments. AWS Secrets Manager and Azure Key Vault are both excellent at what they do, but neither one extends outside its home cloud in any meaningful way. Trying to use AWS Secrets Manager to serve secrets to an Azure workload means building custom sync tooling that neither vendor supports out of the box.
On Kubernetes, all three integrate through the same two mechanisms: the Secrets Store CSI Driver and the External Secrets Operator, both CNCF-adjacent open-source projects that pull secrets from an external store and mount them into pods. Vault additionally offers its own Vault Agent Injector, a sidecar-based pattern that predates the CSI driver approach and remains widely used in Vault-centric shops.
Ecosystem and CI/CD Integration
All three platforms ship official Terraform providers, so infrastructure-as-code teams can provision secrets, policies, and access rules the same way they provision compute or networking resources. That matters more than it sounds, since it means secrets configuration can go through the same pull-request review and CI pipeline as everything else in the stack, rather than living in a separate manual process.
Vault’s plugin architecture is the broadest of the three, with dedicated secrets engines for major relational and NoSQL databases, cloud IAM systems, PKI certificate issuance, SSH certificate signing, and transit encryption-as-a-service. AWS Secrets Manager and Azure Key Vault trade that breadth for depth inside their own ecosystems: Secrets Manager plugs directly into AWS Lambda, ECS, RDS, and CodePipeline without extra configuration, while Key Vault plugs into Azure DevOps, App Service, and Azure Functions with the same zero-friction pattern. GitHub Actions, GitLab CI, and Jenkins all maintain official or community-supported integrations for all three platforms, so pipeline choice rarely forces a secrets-manager decision either way.
Recent Updates: Vault 2.0, the IBM Deal, and a Critical Azure CVE
Three developments from the past few months change how this comparison reads today versus a year ago.
- Vault jumped to a 2.x major version. Vault 2.0.0 reached general availability on April 14, 2026, followed by 2.0.1, 2.0.3, and 2.0.4 through early August, per HashiCorp’s official release notes. It is the first major version bump since the long-running 1.x series, and HashiCorp is still maintaining the final 1.21.x branch as a legacy long-term-support line.
- HCP Vault Secrets was retired. HashiCorp’s lightweight, developer-focused secrets product hit end of sale on June 30, 2025, and end of life on July 1, 2026. Its free and standard tiers were folded into the renamed HCP Vault Dedicated Development and Essentials plans, meaning anyone still referencing “HCP Vault Secrets” in documentation or tutorials is looking at a discontinued product.
- Azure Key Vault disclosed a maximum-severity CVE. Microsoft published CVE-2026-62825 on July 24, 2026, an elevation-of-privilege flaw caused by improper authentication (CWE-287) that let an unauthorized attacker escalate privileges over the network. The flaw is documented in the official CVE record. Security researchers tracking the bug reported it was not observed under active exploitation and was not added to CISA’s Known Exploited Vulnerabilities catalog, with an EPSS exploitation-probability score under 1%.
The Vault 2.0 release matters most for teams still planning migrations off the 1.x line, since new dynamic secrets engines and plugins increasingly target the 2.x API surface first. The Azure CVE is a reminder that even a fully managed, cloud-native vault is not immune to authentication-layer bugs, and it reinforces the case for defense-in-depth practices like short secret lifetimes and tight network-level access controls regardless of which platform you run.
Cost and Reliability Benchmarks From Independent Analysts
Because raw performance numbers for secrets managers are rarely published the way GPU frame rates or EDR detection rates are, the most useful third-party benchmarking for this category comes from independent cost analysts who model real-world usage against each vendor’s official pricing pages. Three separate 2026 analyses converge on similar conclusions.
CostBench’s HashiCorp Vault pricing breakdown puts realistic HCP Vault Dedicated production spend between $1,150 and $6,900 a month once per-client fees are added, well above what a comparable AWS or Azure workload would cost at moderate scale. Independent pricing guides tracking AWS Secrets Manager consistently land on the same $0.40-per-secret, $0.05-per-10,000-calls figures published on AWS’s official pricing page, with a typical 100-secret application landing around $45 a month once API traffic is factored in. Azure-focused analysts modeling the same workload class against Microsoft’s Key Vault pricing page consistently find Standard tier costs staying under $10 a month for typical secret volumes, since the $0.03-per-10,000-operations rate has no accompanying storage fee.
On reliability, cloud-native services benefit from each provider’s regional availability SLAs without any extra configuration. Vault’s availability, by contrast, depends entirely on how the cluster is deployed: a single-node self-hosted Vault has no redundancy, while HCP Vault Dedicated’s Standard tier requires two clusters specifically for multi-datacenter replication, which is also why it costs more than the single-cluster Essentials tier.
Real-World Use Cases: Who Actually Runs What
Vendor marketing rarely reflects how these tools get deployed in practice. Here are five scenarios that map to real adoption patterns.
- Financial services on AWS. AWS’s own customer page states that Fannie Mae uses AWS Secrets Manager to secure API keys, service account credentials, database credentials, and third-party credentials across its infrastructure, a textbook example of a large regulated enterprise standardizing on a single cloud’s native secrets store.
- Multi-cloud platform teams. Organizations running workloads across AWS, Azure, and GCP simultaneously tend to centralize on Vault specifically because no cloud-native tool can serve secrets consistently across all three. A single Vault cluster becomes the one control plane every environment authenticates against.
- Regulated healthcare and government contractors. Teams that must prove FIPS 140-3 conformance on the secrets store itself gravitate toward Vault Enterprise with FIPS mode enabled, or Azure Key Vault Premium for HSM-backed key material, since both carry explicit FIPS 140-3 attestations.
- Azure-native enterprises using DevOps pipelines. Teams already standardized on Microsoft Entra ID and Azure DevOps typically keep certificates, connection strings, and signing keys in Azure Key Vault because the identity and pipeline integration requires zero extra configuration.
- Kubernetes-heavy startups on a budget. Smaller engineering teams running self-managed Kubernetes clusters frequently choose Vault Community Edition specifically because it is free to self-host, accepting the operational tradeoff of running and unsealing the cluster themselves in exchange for avoiding both AWS’s per-secret fee and Azure’s per-operation billing at low secret counts.
Beyond those five patterns, a handful of other scenarios come up often enough to call out directly. Below is a quick-reference table for matching your situation to a platform.
| Your situation | Recommended platform | Why |
|---|---|---|
| Single-cloud AWS shop, want zero ops overhead | AWS Secrets Manager | Native IAM, no cluster to run, predictable per-secret pricing |
| Single-cloud Azure shop already using Entra ID | Azure Key Vault | Lowest per-operation cost, native identity integration, certificates included |
| Multi-cloud or hybrid on-prem plus cloud | HashiCorp Vault | Only option with one control plane across every environment |
| Need short-lived, auto-expiring database credentials | HashiCorp Vault | Native dynamic secrets engines, not just scheduled rotation of static values |
| Regulated industry requiring FIPS 140-3 Level 3 on HSM keys | Azure Key Vault Premium or Vault Enterprise + external HSM | Both carry explicit Level 3 validation for hardware-backed keys |
| Cost-sensitive startup, comfortable self-hosting | HashiCorp Vault Community Edition | Free license, only infrastructure and ops time to pay for |
| Need certificates, keys, and secrets in one place on Azure | Azure Key Vault | Only platform of the three that natively unifies all three object types |
Migration Guide: Moving Between Secrets Managers
Migrating secrets between platforms is a common project, whether you are consolidating a multi-cloud sprawl into Vault or moving off a self-hosted Vault cluster toward a managed cloud service. Here is the general process.
- Inventory every secret and its consumers. List every application, CI job, and human that reads each secret before touching anything, since orphaned secrets and forgotten consumers are the most common cause of migration outages.
- Map access policies to the new platform’s model. Vault’s policy language, AWS IAM policies, and Azure RBAC roles are not directly interchangeable, so recreate the intent, meaning who can read what, rather than trying to translate syntax line by line.
- Stand up the destination in parallel. Never migrate in place. Provision the new secrets store alongside the old one so you can roll back instantly if something breaks mid-migration.
- Script the transfer, don’t do it by hand. Pull each secret from the source with its native CLI, then write it to the destination with its native CLI, logging every transfer for audit purposes.
# Read a secret from Vault
vault kv get -field=password secret/prod/db
# Write the same value into AWS Secrets Manager
aws secretsmanager create-secret \
--name prod/db/password \
--secret-string "the-value-you-just-read"
# Or write it into Azure Key Vault
az keyvault secret set \
--vault-name prod-keyvault \
--name db-password \
--value "the-value-you-just-read"- Cut over consumers one service at a time. Update each application’s secret-fetch configuration individually and verify it reads correctly from the new source before moving to the next service.
- Revoke and delete the old secrets. Once every consumer has cut over and you have confirmed nothing still points at the old store, revoke access and delete the original secrets rather than leaving stale credentials live.
- Rotate everything post-migration. Treat the migration itself as a potential exposure event. Rotate every credential that touched the transfer script once the cutover is complete, even if the migration went cleanly.
Timelines vary widely by secret count and consumer complexity, but the checklist below covers the milestones worth tracking on any migration project regardless of source or destination platform.
| Migration phase | Typical duration | Key risk if skipped |
|---|---|---|
| Secret and consumer inventory | 1-2 weeks | Orphaned secrets left behind, forgotten consumers break after cutover |
| Policy mapping and destination setup | 1 week | Overly broad access policies recreated instead of least-privilege ones |
| Parallel run and scripted transfer | 1-3 weeks depending on secret count | Manual transfer introduces transcription errors in high-entropy values |
| Service-by-service cutover | 2-6 weeks depending on service count | Cutting over multiple services simultaneously makes rollback ambiguous |
| Decommission and post-migration rotation | 1 week | Old secrets left active create a lingering exposure window |
HashiCorp Vault: Pros and Cons
Pros: free and open-source Community Edition, genuine multi-cloud and hybrid support, native dynamic secrets for databases and cloud IAM, FIPS 140-3 conformant Enterprise builds, works identically on-premises or in any cloud.
Cons: self-hosted deployments require real operational investment (unsealing, upgrades, high availability), Vault Enterprise pricing is opaque and custom-quoted, HCP Vault Dedicated’s per-client fees scale unfavorably for large user bases, and the 2.0 major version jump means some older documentation and community tutorials are now out of date.
AWS Secrets Manager: Pros and Cons
Pros: zero infrastructure to manage, native IAM integration with the rest of AWS, straightforward and predictable per-secret plus per-call pricing, HIPAA-eligible and PCI DSS-attested, $200 free credit for new AWS customers.
Cons: AWS-only with no multi-cloud path, the flat $0.40-per-secret monthly fee gets expensive fast at high secret counts, rotation relies on Lambda functions rather than true dynamic credential issuance, and no equivalent of Vault’s cloud-agnostic policy engine for teams outside AWS.
Azure Key Vault: Pros and Cons
Pros: lowest per-operation cost of the three at $0.03 per 10,000 operations, no storage fee at all, handles secrets, keys, and certificates in one service, Premium tier is FIPS 140-3 Level 3 validated, native Microsoft Entra ID integration.
Cons: Azure-only, the July 2026 elevation-of-privilege CVE is a reminder that managed services still carry authentication-layer risk, HSM-backed Premium keys add per-key monthly fees on top of transaction costs, and Managed HSM pricing, roughly $2,300 to $3,650 a month per cluster, is a steep jump for teams that outgrow shared Premium keys.
Which Secrets Manager Should You Choose in 2026
There is no single winner here, because the three products are not really competing for the same buyer. If your infrastructure lives entirely inside one cloud and you want zero operational overhead, use that cloud’s native tool: AWS Secrets Manager for AWS, Azure Key Vault for Azure. Azure’s per-operation pricing wins on raw cost for most low-to-moderate secret counts, while AWS’s flat per-secret fee is easier to forecast at scale even though it costs more on a per-operation basis.
Reach for HashiCorp Vault when any of three conditions apply: you run genuinely multi-cloud or hybrid infrastructure, you need dynamic, short-lived credentials rather than rotated static ones, or your compliance framework specifically requires FIPS 140-3 conformance with full control over the deployment. The free Community Edition makes Vault the cheapest option in raw license cost, but only for teams willing to own the operational burden that AWS and Azure otherwise absorb for you. HCP Vault Dedicated closes that gap at a real dollar cost that climbs quickly with client count, so budget for it accordingly rather than assuming managed Vault means cheap Vault.
List price is never the full picture. A self-hosted Vault cluster that saves $1,000 a month over HCP Vault Dedicated can easily cost more than that in engineer-hours once you account for patching, unsealing after restarts, and building your own high-availability topology. Conversely, AWS Secrets Manager’s simplicity has a hidden cost of its own: teams locked into a single cloud lose negotiating leverage and face a harder migration if a future acquisition or compliance mandate forces a multi-cloud strategy. Weigh the sticker price against the engineering time and lock-in risk each option carries before signing off on a platform for the next few years.
Frequently Asked Questions
Is HashiCorp Vault free to use?
Vault Community Edition is free to self-host under HashiCorp’s Business Source License. You only pay for the infrastructure it runs on and the engineering time to operate it. HashiCorp’s managed HCP Vault Dedicated and self-hosted Vault Enterprise are both paid products, with HCP Vault Dedicated starting around $450 a month for a development-tier cluster.
Which is cheaper, AWS Secrets Manager or Azure Key Vault?
It depends on usage pattern. Azure Key Vault charges $0.03 per 10,000 operations with no storage fee, which wins for workloads with few secrets and high call volume. AWS Secrets Manager charges a flat $0.40 per secret per month plus $0.05 per 10,000 API calls, which can cost more overall but is easier to predict since the storage fee doesn’t scale with traffic.
What happened to HCP Vault Secrets?
HCP Vault Secrets was retired, with end of sale on June 30, 2025, and end of life on July 1, 2026. Its former free and standard tiers were renamed into the HCP Vault Dedicated Development and Essentials plans, so any documentation still referencing “HCP Vault Secrets” describes a discontinued product.
Does Vault 2.0 break compatibility with Vault 1.x?
Vault 2.0.0 reached general availability on April 14, 2026, as the first major version release after the long-running 1.x line, with HashiCorp maintaining the final 1.21.x branch as a legacy long-term-support release for teams that are not ready to upgrade. Teams should review HashiCorp’s official release notes for the specific migration and compatibility guidance before upgrading a production cluster.
Is Azure Key Vault safe to use after the July 2026 CVE?
CVE-2026-62825, an elevation-of-privilege flaw caused by improper authentication, was disclosed on July 24, 2026, and patched by Microsoft as a service-side fix requiring no customer action. Security trackers reported no evidence of active exploitation and an EPSS score under 1%. As with any cloud service vulnerability, it is a reminder to apply least-privilege access policies rather than a reason to avoid the platform outright.
Can I use AWS Secrets Manager or Azure Key Vault across multiple clouds?
Not natively. Both are built for their own cloud’s identity and networking model, and neither vendor offers first-party support for using its secrets store from a different cloud provider. Teams needing a single secrets control plane across AWS, Azure, and GCP typically use HashiCorp Vault instead, since it authenticates against all three clouds’ IAM systems from one cluster.
What are dynamic secrets, and why do they matter?
Dynamic secrets are credentials generated on demand for a specific request and automatically revoked after a short lease period, rather than long-lived values stored and periodically rotated. Vault’s database and cloud IAM secrets engines generate them natively. AWS Secrets Manager and Azure Key Vault instead rotate stored static secrets on a schedule, which reduces risk but does not eliminate the underlying long-lived credential the way true dynamic secrets do.
Do I need Azure Managed HSM instead of Key Vault Premium?
Only if your compliance requirements demand a dedicated, single-tenant HSM cluster rather than the shared HSM pool backing Key Vault Premium’s hardware keys. Managed HSM runs roughly $2,300 to $3,650 a month per cluster, a significant jump from Premium’s per-key pricing of $1 to $5 a month, so most teams should stay on Premium unless an auditor specifically requires single-tenancy.
Related Coverage
- How to Set Up HashiCorp Vault: 13 Steps, 100 Min
- How to Set Up AWS Secrets Manager: 13 Steps, 80 Min
- CyberArk vs BeyondTrust vs Delinea: PAM After the $25B Deal
- AWS Control Tower vs Azure Landing Zone vs GCP
- Wiz vs Prisma vs Defender for Cloud: CSPM Compared
- Entra ID vs Okta vs Auth0: Identity Provider Pricing Gap
- Set Up Zero Trust Network Access: 15 Steps, 100 Min
