An engineering team at a payments startup stored 340 secrets in AWS Secrets Manager - database passwords, third-party API keys, internal service tokens - because that's what the getting-started guide told them to use. Their monthly AWS bill had a $136 line item for secret storage alone, and roughly 280 of those 340 values never rotated and never needed to. They were paying rotation-tier pricing for values that Parameter Store would have stored for free.
That gap between what a service is built for and what teams actually store in it is the real story behind "Secrets Manager vs Parameter Store vs Vault." All three solve secret storage. They diverge sharply on cost model, rotation mechanics, and how much operational ownership you're signing up for.
Secret storage sounds like a solved problem - encrypt a value, control who can read it - until you factor in rotation, multi-cloud reach, and audit granularity at real scale.
Secrets Manager: AWS-native, fully managed. Automatic
rotation for RDS/Aurora/Redshift built in.
$0.40/secret/month, no free tier.
Parameter Store: AWS-native, fully managed. Standard tier
free for up to 10,000 parameters. No
automatic rotation - config-first, not
credential-lifecycle-first.
HashiCorp Vault: Self-hosted (or Vault Enterprise/HCP).
Dynamic secrets generated on-the-fly,
multi-cloud, deepest audit trail. BSL-
licensed since Aug 2023 - OpenBao is the
Linux Foundation-governed MPL fork.
Secrets Manager's entire value proposition is rotation you don't have to build yourself. Parameter Store's entire value proposition is that most of what people call a "secret" is actually static configuration that doesn't need a lifecycle at all. Vault's entire value proposition is dynamic, short-lived credentials across every cloud you run, at the cost of running and securing the service yourself.
AWS Secrets Manager charges $0.40/secret/month plus $0.05/10K API calls. For 500 secrets with no rotation-heavy workload, that's 500 x $0.40 = $200/month, or $2,400/year, before any API charges. Parameter Store's Standard tier is free for up to 10,000 parameters at 4KB each, full KMS encryption included - the same 500 static values there cost $0/month.
The pricing decision isn't "which service is cheaper" in the abstract - it's "does this specific value need automatic rotation, cross-region replication, or resource-based cross-account policies." If yes, Secrets Manager's $0.40/secret earns its cost. If no, that same value in Parameter Store is functionally identical in security posture (same IAM model, same KMS encryption) at zero marginal cost.
Once you exceed 10,000 parameters or need values over 4KB, Parameter Store's Advanced tier costs $0.05/parameter/month - still 8x cheaper than Secrets Manager. The hybrid pattern most mature AWS teams land on: rotating DB credentials and third-party API keys go into Secrets Manager, while static config, feature flags, and non-rotating values stay in Parameter Store.
Vault's dynamic secrets mean there's no long-lived credential to leak - a database credential is generated per-request and expires automatically, so there's nothing sitting in storage to steal.
vault read database/creds/payments-readonly
Vault's dynamic-secrets model is a genuinely different security posture from both AWS services, which store and return the same static value on every request. For multi-cloud teams, or teams whose compliance requirements demand short-lived, per-request credentials rather than long-lived stored ones, that difference is the whole reason to run Vault - not a nice-to-have on top of what AWS already offers.
The trade-off: Vault is self-operated infrastructure. You own HA setup, unsealing, storage backend, upgrades, patching, and the blast radius if Vault itself goes down and takes every downstream credential lookup with it.
In August 2023, HashiCorp relicensed Vault from the open-source Mozilla Public License 2.0 to the Business Source License - the same relicensing event that produced OpenTofu from Terraform. The BSL permits internal use but restricts building a competing managed service on top of Vault without a commercial agreement.
OpenBao is the Linux Foundation-governed fork of Vault's last MPL-licensed version. By February 2026 it had reached v2.5.0 with 5,400+ GitHub stars, and GitLab has provided corporate backing to ship it as a built-in component. API and CLI compatibility with Vault is close but not total - some Vault plugins may not yet have OpenBao equivalents, since the plugin ecosystem is still maturing.
For teams with no licensing objection to BSL, self-hosted Vault remains the more mature option today - deeper plugin ecosystem, more production track record. For teams specifically avoiding another BSL dependency after the Terraform experience, OpenBao is the direct analog to OpenTofu, with the same trade-off: younger project, same governance guarantee.
Cost and Rotation:
| Factor |
Secrets Manager |
Parameter Store |
| Base cost |
$0.40/secret/month |
Free (Standard, up to 10K params) |
| Automatic rotation |
Yes - native RDS/Aurora/Redshift |
No - manual only |
| Max value size |
64 KB |
4 KB (Standard) / 8 KB (Advanced) |
Cost and Rotation, continued:
| Factor |
HashiCorp Vault |
Notes |
| Base cost |
Self-hosted infra cost, or HCP/Enterprise fee |
No per-secret AWS-style fee |
| Automatic rotation |
Yes - plus dynamic, per-request secrets |
Strongest rotation model of the three |
| Multi-cloud |
Yes - AWS, Azure, GCP, on-prem |
AWS services are AWS-only by design |
Default to Parameter Store for anything that doesn't need automatic rotation, cross-account sharing, or cross-region replication - feature flags, static API keys, environment-specific config, even KMS-encrypted SecureString values that never change. This single habit is the highest-leverage cost optimization most AWS-native teams are leaving on the table.
Reserve Secrets Manager for values that genuinely need its rotation lifecycle - database credentials tied to RDS/Aurora/Redshift's native rotation Lambdas, or secrets requiring resource-based cross-account policies. Don't default every "secret-shaped" value into it out of habit; audit an existing Secrets Manager estate periodically for values that would work identically, and free, in Parameter Store.
For Indian fintechs under RBI data-localization or PCI-DSS scope running multi-cloud or hybrid infrastructure - Razorpay-style payment routing spanning AWS and on-prem, Zerodha-style brokerage systems needing audit trails across environments - Vault's dynamic secrets and multi-cloud reach justify the operational overhead of self-hosting in a way that a single-cloud AWS-only team rarely needs. If BSL licensing is a blocker for your legal team, evaluate OpenBao specifically rather than defaulting to Vault Enterprise's commercial tier.
INFORMATIONReferences and Further Reading
Discussion0