Secrets Management: HashiCorp Vault vs AWS Secrets Manager vs SOPS
Hardcoded secrets in code or environment variables are a security incident waiting to happen. Modern secrets management provides encryption, rotation, auditing, and dynamic credentials.
Dynamic Secrets: The Gold Standard
Vault generates database credentials on-demand with automatic expiry. No shared passwords, no rotation scripts, no "who has access to prod DB" questions:
# Get dynamic database credentials (valid 1 hour)
vault read database/creds/api-readonly
# Returns: username=v-app-readonly-abc123 password=A1B2C3...
Comparison
| Feature | Vault | AWS SM | SOPS |
|---|---|---|---|
| Dynamic secrets | Yes | Lambda rotation | No |
| Multi-cloud | Yes | AWS only | Yes |
| Complexity | High | Low | Low |
| Cost | Enterprise $$ | $0.40/secret/mo | Free |
| Git-friendly | No | No | Yes |
Recommendation
Small teams: SOPS with AGE encryption — secrets live in git, encrypted at rest. AWS-native: Secrets Manager with automatic rotation. Enterprise multi-cloud: Vault for dynamic secrets, PKI, and transit encryption.