Secrets Manager vs Parameter Store vs Vault

A payments startup stores 340 values in AWS Secrets Manager: database passwords, partner API keys and internal tokens. Storage alone costs $136 a month. Only about 60 of them are ever rotated, so roughly $112 of that bill buys a rotation feature they never use. (This is an illustrative scenario.)

All three tools store secrets. They differ in cost model, rotation, and how much of the service you operate yourself.

Which secrets tool should you use?

Use Parameter Store for static values, Secrets Manager for credentials that need rotation or cross-account policies, and Vault or OpenBao when you need dynamic credentials or reach beyond AWS. Many mature AWS teams use the first two together.

How do the three compare on cost and features?

Secrets Manager charges per secret, Parameter Store is free at the Standard tier, and Vault costs whatever it takes to run or license. Prices below are list prices as last checked, so confirm them on the pricing pages.

Secrets Manager also bills $0.05 per 10,000 API calls. Parameter Store Standard is free for up to 10,000 parameters of 4 KB each. The Advanced tier lifts those limits (8 KB values, up to 100,000 parameters, parameter policies) at $0.05 per parameter per month, still eight times cheaper than Secrets Manager.

Encryption is equivalent for static values. Parameter Store SecureString and Secrets Manager both use KMS. If you use the AWS managed keys there is no key charge, while a customer managed key adds a monthly key fee and per-request KMS costs for either service.

What does the cost difference look like in practice?

Move values that never rotate out of Secrets Manager. For an estate of 500 secrets where 100 truly rotate:

Do not move a value just to save money if it relies on cross-region replication, a resource policy for cross-account reads, or managed rotation. Check those requirements first.

How do you store each type of value?

Static configuration goes into Parameter Store with a hierarchical path, and rotating credentials go into Secrets Manager with a rotation schedule.

Secrets Manager has ready-made rotation for Amazon RDS, Aurora, Redshift and DocumentDB, and custom rotation Lambdas for everything else. Parameter Store has no rotation, so for a rotating value you would build the lifecycle yourself with a schedule and a Lambda.

For delivery, ECS task definitions can reference either service by ARN in secrets, and on Kubernetes the External Secrets Operator or the Secrets Store CSI driver can sync both into pods. Both keep secrets out of images and environment files in Git.

Where does Vault change the calculation?

Vault generates dynamic secrets: credentials created on request, bound to a lease and revoked when it expires. Neither AWS service does this, because both return a stored value.

Each consumer gets a unique credential, a compromised one dies in an hour, and the audit log ties every credential to its requester. Vault also works across AWS, Azure, GCP and on-premises systems, with a consistent policy model.

The cost is operations. You own high availability, unsealing, storage backends, upgrades, backups and the risk that a Vault outage blocks every credential lookup. HCP Vault, HashiCorp's managed service, shifts that work for a fee.

Inside AWS, check whether native options meet the goal first. IAM database authentication for RDS issues tokens valid for 15 minutes, and IAM roles remove static AWS keys entirely. These give short-lived credentials for many AWS cases without running Vault.

What changed with Vault licensing and OpenBao?

In August 2023 HashiCorp moved Vault from the MPL 2.0 open-source licence to the Business Source License (BSL), which restricts competing commercial offerings. IBM completed its acquisition of HashiCorp in 2025, so Vault is now part of IBM.

OpenBao is a Linux Foundation project forked from the last MPL-licensed Vault code. It keeps an open-source licence and is largely API-compatible. It is the same story as Terraform and OpenTofu, with the same trade-off: a younger project, with some plugins, auth methods and enterprise features that differ from Vault.

For most internal use, the BSL permits running Vault yourself. Involve your legal team if you resell it as part of a product or have a policy against non-open-source dependencies. Test every auth method and secrets engine you use against OpenBao before committing, and check the current release notes for gaps.

How do you avoid the common production failures?

Most problems come from reading too often, caching too little and granting too widely. Four habits prevent most of them:

1. Cache reads. Use the AWS caching clients or the Lambda extension, with a short refresh interval, instead of reading on every request.
2. Scope IAM tightly. Grant ssm:GetParameter on /prod/payments/* and secretsmanager:GetSecretValue on named ARNs, never on *.
3. Use separate keys for sensitive paths. A customer managed KMS key per environment limits the blast radius and gives clean audit trails.
4. Monitor access. Alert on unusual GetSecretValue volume and on failed decrypt calls in CloudTrail.

Trade-offs and Alternatives

Parameter Store and Secrets Manager need no infrastructure, integrate with IAM and CloudTrail, and are the default for AWS-only teams. Vault earns its overhead in multi-cloud and hybrid estates, and where audit rules demand per-request, short-lived credentials.

Production Implementation Guidelines

1. Default to Parameter Store for static config and non-rotating values, with a path convention such as /env/service/name.
2. Use Secrets Manager only where rotation, replication or resource policies are needed, and review the estate every quarter for secrets that do not use them.
3. Prefer IAM roles and RDS IAM authentication over stored credentials wherever the platform supports them.
4. Choose Vault or OpenBao for multi-cloud or dynamic-credential needs, and budget for an on-call owner.
5. Cache reads, scope IAM policies to paths and ARNs, and alert on unusual access.
6. Record each secret's owner and rotation policy so audits do not rely on memory.

References and Further Reading

• AWS Secrets Manager Pricing - Per-secret and API call rates
• Parameter Store Documentation - Standard and Advanced tiers
• HashiCorp Vault Documentation - Dynamic secrets and leases
• OpenBao - Open-source Vault fork under the Linux Foundation