Luca BertonSecrets Management: The Foundation Nobody Talks About
Every enterprise security audit starts with the same question: how do you manage secrets? Database credentials, API keys, TLS certificates, encryption keys — if these are in environment variables, config files, or (worst case) source code, you have a problem that no amount of network security can fix.
The two main enterprise options are HashiCorp Vault (multi-cloud, self-hosted or managed) and AWS Secrets Manager (cloud-native, AWS-only). The choice depends on your cloud strategy and compliance requirements.
AWS Secrets Manager vs Vault: Quick Answer
Quick answer: AWS Secrets Manager wins for AWS-only teams wanting zero operational overhead and tight AWS integration. HashiCorp Vault wins for multi-cloud environments needing dynamic secrets, PKI, or encryption as a service. The full feature-by-feature comparison is below.
Comparison
| Feature | HashiCorp Vault | AWS Secrets Manager |
|---|---|---|
| Cloud support | Multi-cloud + on-premises | AWS only |
| Dynamic secrets | Yes (DB, AWS, Azure, GCP, K8s) | Rotation only (not truly dynamic) |
| PKI | Full CA and certificate management | No (use ACM separately) |
| Encryption as a service | Transit engine (encrypt/decrypt API) | No (use KMS separately) |
| Kubernetes integration | CSI driver, Agent Injector, VSO | CSI driver (ASCP) |
| Audit logging | Comprehensive (every request logged) | CloudTrail integration |
| Operational overhead | High (HA cluster, unsealing, upgrades) | Zero (fully managed) |
| Licence | BSL 1.1 / HCP Vault (managed) | AWS service (pay per secret + API call) |
Kubernetes Recipes
A practical guide for container orchestration and deployment by Grzegorz Stencel & Luca Berton (Apress).
Watch on Skillshare →When Vault Wins
HashiCorp Vault wins over AWS Secrets Manager when you need multi-cloud coverage, dynamic secrets, or PKI — capabilities AWS Secrets Manager doesn't offer natively:
- Multi-cloud or hybrid — One secret management plane across AWS, Azure, GCP, and on-premises
- Dynamic secrets — Vault generates short-lived, unique credentials per application instance. This eliminates credential sharing and simplifies rotation.
- PKI infrastructure — Running your own certificate authority for mTLS, service mesh, and internal certificates
- Advanced use cases — Encryption as a service, KMIP, SSH certificate signing, OIDC provider
- Data sovereignty — Self-hosted Vault means secrets never leave your infrastructure
When AWS Secrets Manager Wins
AWS Secrets Manager wins over HashiCorp Vault when you're AWS-only and want zero operational overhead — no cluster to run, no unsealing, no upgrades:
- AWS-only — If you're 100% on AWS, Secrets Manager integrates natively with RDS, ECS, EKS, Lambda
- Operational simplicity — Zero infrastructure to manage. No unsealing, no HA cluster, no upgrades.
- Small teams — If you don't have dedicated security infrastructure engineers, managed beats self-hosted
- Cost at small scale — $0.40/secret/month + $0.05/10K API calls is cheap for moderate use
Federated Learning and Privacy-preserving RAGs
Implement secure AI models using federated learning techniques.
Start on Pluralsight →Compliance Perspective (DORA/NIS2/ISO 27001)
- DORA Art. 7 (ICT systems security): Both satisfy the requirement for secure credential management. Vault's dynamic secrets reduce blast radius of credential compromise.
- NIS2 Art. 21 (encryption): Vault's Transit engine provides application-level encryption without managing keys in application code.
- ISO 27001 A.9 (access control): Vault's granular policies and comprehensive audit logging provide stronger evidence for certification audits.
- Key rotation: Vault automates rotation for 30+ secret types. Secrets Manager automates rotation for RDS, Redshift, and custom Lambda-based rotation.
Decision Framework
Choose Vault if: Multi-cloud, need dynamic secrets or PKI, strict data sovereignty requirements, have ops team to run it.
Choose AWS Secrets Manager if: AWS-only, want zero operational overhead, moderate secret management needs.
Consider HCP Vault if: Want Vault features without self-hosting. Best of both worlds but adds vendor dependency.
EU AI Act Compliance Checklist
40-point checklist covering risk classification, data governance, transparency, and human oversight. Based on the official regulation.
Get Free Checklist →