HashiCorp Vault vs AWS Secrets Manager vs Doppler [2026]

Every production outage caused by a leaked API key or an expired certificate traces back to the same root problem: secrets scattered across config files, Slack messages, and .env files that nobody is tracking. By October 2026, three platforms dominate the conversation among platform engineers trying to fix that mess: HashiCorp Vault, now owned and re-licensed by IBM; AWS Secrets Manager, the default choice for teams already locked into AWS; and Doppler, the developer-first SaaS that skips infrastructure entirely. Each takes a fundamentally different approach to the same problem, and the “right” pick now depends less on features than on licensing terms, billing models, and how much operational overhead a team is willing to carry.

This comparison breaks down pricing, architecture, security posture, and real deployment scenarios for all three platforms, plus the open-source fork, OpenBao, that emerged after HashiCorp’s 2023 licensing change. The goal: give engineering leads and DevOps teams a clear, data-backed answer for which secrets manager fits their stack in 2026, not a vendor-sponsored recommendation.

None of these three platforms is objectively “best.” They solve overlapping but distinct problems: Vault is an infrastructure component you own and operate (or rent through HCP); AWS Secrets Manager is a billing line item inside an AWS account you already pay for; Doppler is a SaaS subscription that trades infrastructure ownership for a monthly seat fee. Picking between them without comparing licensing terms, dynamic-secrets capability, and real unit economics is how teams end up re-platforming eighteen months later at far higher switching cost than if they had modeled the decision properly up front.

·

Google · Preferred Sources

Don't miss new tech stories on Google

Add Tech Insider once in the Google app and our stories appear in your news suggestions.

Add Now

Why Secrets Management Got More Complicated in 2026

Secrets management used to be a solved problem: store API keys and database passwords in a vault, rotate them periodically, done. That changed on three fronts this year. First, IBM closed its acquisition of HashiCorp in early 2025, and by 2026 Vault had moved to IBM’s enterprise support lifecycle, jumping to a 2.0 version line, its first major version bump since 2018. Second, HashiCorp retired HCP Vault Secrets, its lightweight managed offering, as of June 30, 2026, pushing smaller teams who wanted “Vault without the operational weight” toward either the full HCP Vault Dedicated tier or a competitor entirely. Third, the rise of AI agents and machine-to-machine authentication exploded the number of non-human identities that need credentials, and credential sprawl from LLM tooling has become its own category of incident.

That last point is not theoretical. Security researchers tracking exposed Model Context Protocol (MCP) servers found roughly 82,000 publicly accessible files, with roughly one in eight exposing live credentials, according to reporting on the MCP credential leak. Every one of those incidents is a secrets-management failure. Teams are no longer just protecting a handful of database passwords; they are protecting API tokens issued to autonomous agents that can call dozens of services without a human in the loop. That shift is why the Vault-vs-Secrets-Manager-vs-Doppler decision now carries more weight than it did two years ago.

There is also a quieter, more mundane driver: cost control. DRAM and infrastructure prices climbed through 2026, and finance teams started scrutinizing every recurring cloud line item, including the secrets-management bill. A platform that looked like a rounding error at 500 secrets can turn into a five-figure annual surprise at 50,000 secrets if nobody modeled the per-call pricing in advance. That is precisely the kind of unit-economics mistake this comparison is built to prevent.

HashiCorp Vault in 2026: IBM Ownership, a New Version Line, and a License That Still Bites

HashiCorp Vault changed its license from the open-source MPL 2.0 to the Business Source License (BSL) 1.1 in August 2023, starting with version 1.15. The BSL blocks competitors from offering Vault as a hosted service, though each release converts back to MPL 2.0 four years after publication. That single decision reshaped the entire secrets-management market and triggered the OpenBao fork, discussed below.

IBM closed its acquisition of HashiCorp in early 2025, and the Vault product line now runs on IBM’s “Support Cycle-2” lifecycle: two years of base support, one year of extended support, and three years of sustained support per release. Vault jumped to version 2.0 in April 2026, with the 2.x bump tied to that lifecycle change rather than a ground-up rewrite. The newest major release is now Vault 2.2, which HashiCorp describes as generally available, following Vault 2.1.1 in September 2026 (published as a security release) and Vault 2.1.2 in HashiCorp’s October 8, 2026 release notification.

Functionally, Vault remains the most capable of the three platforms for dynamic secrets. It can generate short-lived database credentials, cloud IAM credentials, and PKI certificates on demand, rather than storing static values that sit around waiting to leak. That dynamic-secrets engine, combined with fine-grained policy-as-code and deep Kubernetes/Terraform integration, is why large enterprises with dedicated platform teams still choose Vault over SaaS alternatives. The tradeoff is operational cost: someone has to run, patch, and scale a Vault cluster, or pay HashiCorp to do it through HCP Vault Dedicated.

Community, Enterprise, and the BSL Four-Year Clock

Vault ships in two tiers: a free Community edition and a paid Enterprise edition that adds features like namespaces, performance replication, and automated disaster recovery. Both have carried the Business Source License since version 1.15, which means every release is source-available rather than open source the day it ships, but it also means every release eventually becomes fully open under MPL 2.0, four years after its original publication date. In practical terms, a team self-hosting Vault 1.15 (released August 2023) sees that specific release convert to MPL 2.0 around August 2027. Newer releases, including the 2.x line, reset that four-year clock each time, so the “current” version a team is actually running is almost always still under BSL terms.

HCP Vault Dedicated: What the Managed Tier Actually Bills

HCP Vault Dedicated is HashiCorp’s fully managed version of Vault Enterprise, deployable inside AWS or Azure, and it is now the only managed Vault option since HCP Vault Secrets was retired on June 30, 2026. Pricing runs on an hourly cluster charge that scales with tier, cluster size, and region, and the Essentials and Standard tiers add a separate per-authenticated-client charge on top of the cluster fee. HashiCorp does not publish a single all-in price list for this, which is itself a planning risk: teams budgeting for HCP Vault Dedicated should request a sized quote early rather than assuming list-price estimates will hold at contract time.

AWS Secrets Manager: The Default Choice for AWS-Native Teams

AWS Secrets Manager takes the opposite approach from Vault: no cluster to run, no license to negotiate, just an API call. It integrates natively with IAM, Lambda, RDS, and the rest of the AWS ecosystem, and it supports automatic rotation through Lambda rotation functions for supported services. For teams that are already fully committed to AWS, this removes an entire category of infrastructure decisions.

The catch is billing. Secrets Manager charges $0.40 per secret per month plus $0.05 per 10,000 API calls, confirmed on AWS’s current pricing page as of October 1, 2026. That sounds trivial at small scale, but it adds up fast for teams with thousands of secrets or high-frequency secret reads, such as services that fetch credentials on every cold start. A fleet of 10,000 secrets read 40 times a day for a month works out to roughly $4,060 in combined storage and API charges, a cost structure that rewards caching secrets locally rather than fetching them on every request.

Secrets Manager has no public CVE record of its own in the National Vulnerability Database as a standalone product, largely because AWS patches the service directly rather than shipping versioned software customers install. That is a genuine security advantage: there is no patch cadence to manage, because AWS manages it. The visible 2026 vulnerabilities involving Secrets Manager are in third-party code that uses it as a backend, not in the service itself, as detailed later in this piece.

The rotation story is also worth a closer look, because “automatic rotation” means different things depending on the target. For RDS, Aurora, and DocumentDB, AWS provides pre-built Lambda rotation templates that Secrets Manager can trigger on a schedule with almost no custom code. For anything outside that managed-database list, say a third-party SaaS API key or a self-hosted database, teams have to write and maintain their own rotation Lambda function. That is a meaningful amount of custom glue code for organizations with heterogeneous infrastructure, and it is one of the main reasons teams running mixed AWS/non-AWS estates often end up pairing Secrets Manager with Vault rather than choosing one exclusively.

Doppler: The Developer-First SaaS Alternative

Doppler skips the infrastructure conversation entirely. It is a hosted secrets and environment-variable manager built around a developer workflow: run doppler run in front of any command, and it injects the right environment variables for that project and environment, with no agent, sidecar, or self-hosted cluster required. For small and mid-sized engineering teams who find Vault’s operational overhead disproportionate to their actual secret count, Doppler is the pragmatic middle ground between “raw AWS Secrets Manager API calls” and “run a HashiCorp cluster.”

Pricing is seat-based rather than usage-based: Doppler’s Team plan runs $21 per seat per month, while the Developer plan gives the first three users free and then charges $8 per additional seat per month, both figures pulled from Doppler’s current public pricing. That model flips the AWS calculus: a team with thousands of secrets but a small headcount pays far less on Doppler than on a pure per-secret AWS bill, while a large team with few secrets may find the seat-based model more expensive than expected.

Doppler’s open-source CLI on GitHub (DopplerHQ/cli) sits in the low hundreds of stars, reflecting that most of the product value lives in the hosted backend rather than the client tooling. The client keeps moving, though: Doppler’s August 2026 changelog lists CLI v3.76.5, which publishes Docker images for arm64 in addition to amd64, distributes the macOS Homebrew package as a cask, and disables CLI analytics by default. That is a meaningful contrast with Vault and OpenBao, where the entire product is open source and star counts proxy for broader community trust and scrutiny.

Doppler differentiates itself through its integrations page, which connects secrets directly to the platforms teams already deploy on, including major CI/CD providers, container orchestrators, and serverless platforms, syncing a single source of truth out to each destination rather than making every service call back to a central API on every read. That sync-based model reduces the API-call volume problem that drives up AWS Secrets Manager’s bill at scale, since Doppler’s billing does not meter per-read API calls the way AWS does. Doppler’s August 2026 changelog shows that integration list still growing, with GitHub Copilot Agents synchronization, OpenAI service-account rotated secrets, and OIDC authentication for GCP and Azure that removes the need to store credentials for those syncs.

The OpenBao Fork: What Happens When You Don’t Want to Pay the BSL Tax

When HashiCorp moved Vault to the Business Source License in 2023, a group of maintainers and companies that depended on a fully open-source secrets manager forked the last MPL-licensed release and created OpenBao, now hosted under the Linux Foundation and developed as an OpenSSF sandbox project. OpenBao aims to stay API-compatible with Vault, so teams migrating off BSL-licensed Vault do not need to rewrite their integrations, only repoint their endpoints.

The project has momentum behind it. GitLab adopted OpenBao as its native CI/CD secrets manager and holds a seat on OpenBao’s Technical Steering Committee, a strong signal of production-grade trust from a company that itself serves millions of developers. On GitHub, the hashicorp/vault repository carries roughly 36,161 stars against roughly 7,137 for openbao/openbao as of a September 2026 snapshot, a gap that reflects Vault’s decade-long head start rather than a judgment on OpenBao’s maturity. OpenBao’s current release line sits at 2.7.1, dated October 1, 2026, and the project has already replicated several Vault Enterprise-only features that were previously paywalled, including control groups and external key management, in its open build.

For teams evaluating secrets managers from scratch in 2026, OpenBao effectively becomes a fourth option sitting next to Vault, AWS Secrets Manager, and Doppler: all of Vault’s dynamic-secrets architecture, none of the BSL licensing terms, at the cost of a smaller (but growing) ecosystem and fewer enterprise support guarantees than IBM-backed Vault Enterprise offers.

The risk calculus runs the other way for organizations that already pay for Vault Enterprise support contracts and need guaranteed SLAs, dedicated incident response, and a single throat to choke when something breaks at 3 a.m. For those teams, the smaller OpenBao community and its lack of a commercial support arm (beyond informal community and third-party consulting support) outweighs the license savings. This is the same build-vs-buy tradeoff that shows up across the open-source infrastructure world, and it is worth weighing against total engineering headcount, not just the sticker price of the license.

Specs Comparison: Vault vs AWS Secrets Manager vs Doppler vs OpenBao

Feature	HashiCorp Vault	AWS Secrets Manager	Doppler	OpenBao
Current version	2.2 (generally available)	Fully managed, no version	Continuously deployed SaaS	2.7.1 (Oct. 1, 2026)
License	Business Source License 1.1	Proprietary AWS service	Proprietary SaaS	MPL 2.0 (fully open source)
Deployment model	Self-hosted or HCP Vault Dedicated	Fully managed AWS service	Fully managed SaaS	Self-hosted
Dynamic secrets	Yes — databases, cloud IAM, PKI	No — static secrets only	No — static secrets/config	Yes — Vault-compatible
Automatic rotation	Yes, via dynamic secrets engines	Yes, via Lambda rotation functions	Limited, via integrations	Yes, Vault-compatible
Multi-cloud support	Yes — cloud-agnostic	AWS-native only	Yes — cloud-agnostic	Yes — cloud-agnostic
KV versioning	Yes (KV v2 engine)	Yes (version stages)	Yes (environment history)	Yes (KV v2 compatible)
Governance body	IBM (HashiCorp)	Amazon Web Services	Doppler Inc. (private)	Linux Foundation / OpenSSF
GitHub stars (approx., Sept. 2026)	36,161	N/A (closed source)	~388 (CLI only)	7,137
Operational overhead	High (self-hosted) / Medium (HCP)	Low (fully managed)	Low (fully managed)	High (self-hosted)
Known 2025-2026 CVEs	CVE-2025-4166, CVE-2025-5999	None assigned to the service directly	None publicly disclosed	None publicly disclosed
Best for	Large enterprises, regulated industries	AWS-committed teams	Startups, small-to-mid engineering teams	Teams avoiding the BSL, GitLab-style CI/CD

Pricing Breakdown: What Each Platform Actually Costs

Pricing is where these three platforms diverge most sharply, because each uses a fundamentally different billing unit: Vault bills by cluster-hour and client count, AWS bills by secret and API call, and Doppler bills by seat. That makes direct comparison difficult without picking a concrete scenario, so the table below uses published list prices and documented estimates rather than custom enterprise quotes, which none of the three vendors publish in full.

Plan/tier	Price	Billing unit	Notes
HCP Vault Dedicated — Development	~$450/month	Per cluster	Estimated figure; HashiCorp does not publish a universal list price
HCP Vault Dedicated — Essentials	~$1,152/month + ~$72.92/client/month	Per cluster + per client	Client charge covers authenticated apps, services, and users
Vault self-hosted (Community)	$0 (software only)	N/A	BSL-licensed; infrastructure and ops cost not included
Vault Enterprise self-hosted	Custom quote only	Per client	Market estimates range roughly $1–$3 per client/month before enterprise discounts
AWS Secrets Manager	$0.40/secret/month + $0.05/10,000 API calls	Per secret + per API call	No seat fees; scales directly with secret count and read frequency
Doppler — Developer plan	Free for first 3 users, then $8/seat/month	Per seat	No per-secret charge
Doppler — Team plan	$21/seat/month	Per seat	14-day trial available
OpenBao self-hosted	$0 (fully open source)	N/A	No vendor license fee at any tier; infrastructure cost still applies

The practical takeaway: a five-person startup with a modest secret count will almost always pay less on Doppler’s Developer plan than on either AWS Secrets Manager at scale or any flavor of Vault. A large enterprise with thousands of secrets accessed at high frequency, by contrast, can see AWS’s per-call pricing balloon past what a flat-rate HCP Vault Dedicated cluster would cost, which is exactly the scenario Vault’s dynamic-secrets model was built to handle efficiently; generate a credential on demand with a short lease instead of storing and re-reading a static one.

Cost Modeling: Three Team Sizes, Three Different Winners

Running the numbers against three common team profiles shows how little the “best” choice has to do with brand reputation. A 10-person startup with roughly 200 secrets and low read frequency pays about $80-$210 a month on Doppler’s Developer or Team plans, versus roughly $80 a month in storage alone on AWS Secrets Manager before API-call charges, and either a sunk HCP Vault Dedicated cluster fee well north of $450 a month or the engineering time to run Vault Community in-house. At this scale, Doppler or raw AWS Secrets Manager both beat standing up Vault.

A 100-person engineering org with roughly 5,000 secrets and moderate read frequency flips that math. Seat-based Doppler pricing starts compounding against headcount rather than secret count, AWS Secrets Manager’s storage fee alone reaches $2,000 a month before any API calls, and a mid-tier HCP Vault Dedicated cluster or self-hosted Vault Enterprise contract starts looking proportionate once dynamic secrets reduce the number of static credentials that need separate storage and rotation tracking in the first place.

A 1,000-plus engineer enterprise with multi-cloud infrastructure and tens of thousands of secrets is where Vault’s architecture earns its complexity. Independent pricing research from WZ-IT’s OpenBao-versus-Vault comparison, CostBench’s HashiCorp Vault pricing breakdown, and Start with Identity’s Vault vendor review all converge on the same conclusion from different angles: at this scale, per-client or per-cluster pricing models reward teams that minimize the number of long-lived static credentials, which is the entire point of Vault’s dynamic-secrets engines. AWS’s per-secret, per-call model has no equivalent lever to pull.

Security Track Record: CVEs and Known Incidents

No secrets manager is immune to vulnerabilities, and 2025-2026 produced disclosures for Vault that are worth understanding before committing to a platform. The National Vulnerability Database lists CVE-2025-4166, published May 2, 2025, in which Vault’s KV version 2 plugin could unintentionally expose sensitive information in server and audit logs when a user submitted a malformed payload through the REST API. It was fixed in Vault Community and Enterprise 1.19.3 and corresponding patches for older supported branches.

A second, more serious flaw, CVE-2025-5999, published August 1, 2025, allowed a privileged Vault operator with write access to the root namespace’s identity endpoint to escalate token privileges to Vault’s root policy, essentially a path from “trusted insider” to “full admin.” HashiCorp fixed it in Vault Community Edition 1.20.0 and in Enterprise 1.20.0, 1.19.6, 1.18.11, and 1.16.22.

AWS Secrets Manager has no CVE assigned directly to the service, since AWS patches the underlying infrastructure without shipping customer-installed software. The service does appear indirectly in CVE-2026-43867 and CVE-2026-46590, both Apache Camel vulnerabilities involving unsafe Java deserialization in post-quantum-cryptography key-lifecycle managers that can optionally use AWS Secrets Manager or HashiCorp Vault as a storage backend. Those are vulnerabilities in Apache Camel’s integration code, not in AWS Secrets Manager or Vault themselves, but they underscore a broader point: the security of any secrets manager depends heavily on the client libraries and middleware that talk to it.

Doppler and OpenBao have no publicly disclosed CVEs as of this writing, which is a data point in their favor but not a substitute for independent security review; a smaller public vulnerability count can simply reflect a smaller, less-scrutinized attack surface rather than a stronger one. Teams evaluating any of these four options should weigh disclosed CVE history alongside the size and maturity of the project’s security research community, not as the sole signal.

Dynamic Secrets: The Feature That Actually Separates These Platforms

The single biggest architectural difference between Vault/OpenBao and the other two platforms is dynamic secrets. HashiCorp describes Vault’s core job as centrally storing, rotating, syncing, and distributing dynamic secrets, including tokens, passwords, certificates, and encryption keys, rather than just warehousing static values. In practice that means a service requesting database access gets a credential generated on the spot with a short time-to-live, and that credential simply expires rather than needing manual rotation or revocation. OpenBao, built to stay API-compatible, inherits this model directly.

AWS Secrets Manager and Doppler both work primarily with static secrets: values you create, store, and rotate on a schedule. Secrets Manager narrows that gap with automatic rotation through Lambda functions for select AWS database services, which handles the “rotate on a schedule” problem well for RDS, Aurora, and similar managed databases, but it does not generate a brand-new, uniquely scoped credential per request the way Vault’s dynamic secrets engines do. Doppler’s rotation support leans on its integrations ecosystem rather than a built-in dynamic-credential engine, which is consistent with its positioning as a configuration and environment-variable layer rather than a full PKI and database-credentialing system.

For teams running compliance-heavy workloads, financial services, healthcare, government contracts, this difference matters more than price. A SOC 2 or HIPAA auditor will ask pointed questions about credential lifetime and blast radius if a service account’s database password never expires. Vault and OpenBao answer that question architecturally; AWS Secrets Manager and Doppler answer it through scheduling and process discipline.

Real-World Deployment Scenarios

Here is how the calculus plays out across six concrete situations engineering teams actually face in 2026. None of these are hypothetical archetypes pulled from a vendor slide deck; they map directly to the pricing models and architectural capabilities documented above.

• A Series A startup with 15 engineers and a handful of microservices gets the fastest time-to-value from Doppler’s free three-seat tier or the $8/seat Developer plan. No infrastructure to provision, no license to parse, and the CLI integrates into CI pipelines in minutes.
• A fintech running a regulated AWS environment with RDS and Lambda benefits most from AWS Secrets Manager’s native rotation for RDS/Aurora and tight IAM integration, provided the team monitors per-secret and per-call costs as the fleet grows past a few thousand secrets.
• A 500-person enterprise with a dedicated platform engineering team and multi-cloud infrastructure is the classic HCP Vault Dedicated or self-managed Vault Enterprise customer, where dynamic database credentials and PKI issuance justify the operational and license cost.
• A company that wants Vault’s architecture without the BSL, particularly one already running GitLab CI/CD at scale, is well served by OpenBao, which GitLab itself has adopted as its native secrets backend.
• A team building AI agent pipelines that call dozens of third-party APIs needs whichever platform makes short-lived, narrowly scoped credentials easiest to issue and revoke automatically. That points toward Vault or OpenBao’s dynamic secrets engines over static-secret stores, given how exposed MCP servers and agent credential sprawl became in 2026, as covered in our MCP gateway credential security setup guide.
• A mid-sized SaaS company migrating off a legacy, hand-rolled secrets store (a shared encrypted file, a config-management vault, or an internally built wrapper around a key management service) typically lands on either Doppler, for speed of adoption, or OpenBao, if the team already has Kubernetes and Terraform expertise and wants dynamic secrets without a BSL conversation with legal.

Migration Guide: Moving Between Secrets Managers

Migrating secrets managers is operationally risky if done carelessly, since a dropped or mistyped secret during cutover can take down production. Here is the sequence most platform teams follow when moving off one of these three platforms. Budget more calendar time than feels necessary; the biggest real-world failures come from rushing the cutover window, not from picking the wrong destination platform.

• Step 1 — Inventory every secret and its consumers. Before touching anything, map which services read which secrets, and how often. This catches orphaned secrets nobody remembers creating.
• Step 2 — Classify static vs dynamic secrets. Values that already rotate automatically (database credentials via Vault’s dynamic engines, for example) need different migration handling than static API keys.
• Step 3 — Stand up the destination platform in parallel. Never migrate directly into production. Run the new platform (Doppler project, Secrets Manager namespace, or OpenBao cluster) alongside the old one first.
• Step 4 — Migrate read-only consumers first. Point low-risk, read-heavy services at the new platform before touching anything that writes or rotates secrets.
• Step 5 — Re-point rotation logic. If moving away from Vault’s dynamic secrets engines toward AWS Secrets Manager or Doppler, rebuild equivalent rotation schedules using Lambda rotation functions or Doppler’s integration hooks, since neither replicates Vault’s on-demand credential generation out of the box.
• Step 6 — Cut over application config, not infrastructure, last. Update environment variables and config references to pull from the new source only after validating the new platform under real load.
• Step 7 — Revoke and delete old secrets with a grace period. Keep the old platform’s secrets valid but logged for 7-14 days before full deletion, in case a forgotten service still references them.
• Step 8 — For BSL-to-OpenBao migrations specifically, take advantage of OpenBao’s API compatibility: most Vault client libraries and Terraform providers work against OpenBao with only an endpoint change, since the fork was explicitly designed to avoid forcing a rewrite.

Teams running infrastructure-as-code pipelines should pair any of these migrations with policy scanning to catch hardcoded secrets that bypass the vault entirely; a tool like Checkov, covered in our IaC security scanning setup guide, catches exactly that class of mistake before it reaches production.

Pros and Cons: Vault vs AWS Secrets Manager vs Doppler

Laid side by side, the tradeoffs stop looking like “which vendor is better” and start looking like “which constraints can your team live with.” Vault’s weaknesses are entirely about licensing and operational weight, not capability. AWS Secrets Manager’s weaknesses are about cost scaling and the absence of dynamic credentials, not reliability. Doppler’s weaknesses are about ceiling, not floor, it does the basics extremely well but was never built to be a PKI or database-credentialing system.

HashiCorp Vault

• Pro: Most capable dynamic secrets engine of the three, covering databases, cloud IAM, and PKI.
• Pro: Deep ecosystem for Kubernetes, Terraform, and enterprise identity providers.
• Pro: Now backed by IBM’s enterprise support lifecycle and resources.
• Con: Business Source License restricts competing hosted-service use and complicates legal review for some organizations.
• Con: Highest operational overhead of the three if self-hosted; HCP pricing is opaque without a sales quote.
• Con: HCP Vault Secrets, the lightweight managed tier, was retired as of June 30, 2026, removing a lower-cost managed option.

AWS Secrets Manager

• Pro: Zero infrastructure to manage; AWS patches and scales it.
• Pro: Tight native integration with IAM, Lambda, and RDS rotation.
• Pro: No separate CVE patch cycle for customers to track.
• Con: Per-secret and per-API-call billing can scale poorly for large, high-frequency fleets.
• Con: No true dynamic secrets engine; rotation is scheduled, not generated on demand.
• Con: Effectively AWS-only; multi-cloud teams need a separate tool for non-AWS workloads.

Doppler

• Pro: Fastest setup of the three; no infrastructure or cluster to provision.
• Pro: Seat-based pricing is predictable and cheap for small teams.
• Pro: Strong developer experience with a simple CLI workflow.
• Con: No dynamic secrets engine; fundamentally a static secrets/config store.
• Con: Fully proprietary SaaS; no self-hosted option for data-residency-sensitive teams.
• Con: Seat-based billing can get expensive for large engineering orgs regardless of secret count.

Use-Case Recommendations

• Choose HashiCorp Vault if you run a multi-cloud or hybrid environment, need dynamic database/cloud credentials, and have a platform team to operate it or budget for HCP Vault Dedicated.
• Choose AWS Secrets Manager if your workloads live entirely inside AWS and you want zero infrastructure overhead, accepting scheduled rather than dynamic rotation.
• Choose Doppler if you are a small-to-mid-sized team that wants secrets and environment configuration solved in an afternoon, without standing up any backend infrastructure.
• Choose OpenBao if you want Vault’s dynamic-secrets architecture under a fully open-source license, especially if you already run GitLab CI/CD.
• Choose a hybrid approach (Vault or OpenBao for dynamic database/cloud credentials, Doppler or Secrets Manager for simpler app-level config) if your organization has both compliance-heavy workloads and fast-moving product teams with different needs.

The Verdict: Which Secrets Manager Wins in 2026

There is no single winner here, because these three platforms are not really competing for the same buyer. AWS Secrets Manager wins on pure operational simplicity for AWS-native shops, at the cost of per-call billing that punishes high-frequency secret reads and a licensing model, “just an AWS service”, that offers no path off AWS. Doppler wins on time-to-value and predictable seat-based pricing for smaller teams that do not need dynamic credential generation, but it offers no self-hosted option and no dynamic secrets engine, which rules it out for regulated workloads that require on-demand, short-lived credentials.

HashiCorp Vault remains the technical leader on capability, specifically the dynamic secrets engine that generates short-lived database, cloud, and PKI credentials rather than storing static ones, which is precisely the feature regulated industries and large multi-cloud enterprises cannot do without. But the Business Source License, now paired with IBM’s ownership and the retirement of the lightweight HCP Vault Secrets tier, raises the bar for teams unwilling to either self-host a cluster or sign an enterprise contract. That gap is exactly why OpenBao, GitLab’s chosen CI/CD secrets backend, has grown into a legitimate fourth option: Vault’s architecture, Vault’s API compatibility, none of the licensing friction.

The practical data point worth remembering: a five-figure annual spend buys a fully managed, seat-priced Doppler setup for a startup; a near-identical spend on AWS Secrets Manager can be consumed entirely by API-call volume at scale; and the same budget on HCP Vault Dedicated barely covers a single mid-tier cluster before per-client charges kick in. Pick based on your actual secret volume, read frequency, and whether dynamic credential generation is a compliance requirement or a nice-to-have, not on which name is most familiar.

Frequently Asked Questions

Is HashiCorp Vault still open source in 2026?
No, not in the traditional sense. Vault has been licensed under the Business Source License 1.1 since version 1.15 in August 2023, and that remains true for the current 2.2 release. Each BSL release converts to the fully open MPL 2.0 license four years after its publication date, but the current versions are source-available rather than open source in the OSI sense. Teams wanting a fully open-source, Vault-compatible alternative should look at OpenBao.

What is OpenBao and why does it exist?
OpenBao is a fork of the last MPL-licensed version of HashiCorp Vault, created after HashiCorp’s 2023 BSL relicensing. It is hosted under the Linux Foundation as an OpenSSF sandbox project, aims to stay API-compatible with Vault, and has been adopted by GitLab as its native CI/CD secrets manager.

Does AWS Secrets Manager support dynamic secrets like Vault?
Not in the same way. AWS Secrets Manager supports automatic rotation through Lambda rotation functions for supported services such as RDS and Aurora, which rotates a static secret on a schedule. Vault and OpenBao generate brand-new, short-lived credentials on demand for each request through their dynamic secrets engines, which is architecturally different from scheduled rotation.

Is Doppler a good fit for enterprise compliance requirements?
It depends on the requirement. Doppler is fully proprietary SaaS with no self-hosted option, so organizations with strict data-residency or on-premises mandates typically rule it out. For teams without those constraints, Doppler works well for general secrets and environment-configuration management, though it lacks a dynamic secrets engine for workloads that specifically require on-demand, short-lived credentials.

What happened to HCP Vault Secrets?
HashiCorp retired HCP Vault Secrets, its lightweight managed secrets offering, as of June 30, 2026. Customers were directed to migrate to HCP Vault Dedicated, the full managed Vault Enterprise offering, which carries higher per-cluster and per-client pricing than the retired lightweight tier did.

How much does HashiCorp Vault actually cost?
HashiCorp does not publish a single universal price. Self-hosted Vault Community is free software, though infrastructure and operational costs apply. HCP Vault Dedicated uses hourly cluster pricing that varies by tier and region; third-party estimates put the Development tier around $450/month and the Essentials tier around $1,152/month plus roughly $72.92 per authenticated client per month. Enterprise self-hosted licensing requires a custom quote from HashiCorp.

Were there any serious HashiCorp Vault vulnerabilities in 2025 or 2026?
Yes. CVE-2025-4166 (May 2025) involved sensitive information exposure in Vault’s KV v2 audit logs. CVE-2025-5999 (August 2025) allowed a privileged operator to escalate token privileges to Vault’s root policy. Both were patched in subsequent Vault releases, and organizations running self-hosted Vault should confirm they are on a patched version.

Can I migrate from Vault to OpenBao without rewriting my integrations?
In most cases, yes. OpenBao was explicitly designed to remain API-compatible with Vault, so Terraform providers, client libraries, and application code that talk to Vault’s API generally work against OpenBao with only an endpoint change, though teams should test thoroughly before cutting over production traffic.