Secrets management · Comparison
AWS Secrets Manager vs HCP Vault Dedicated
2 products compared side by side: what you pay for with each one first, then the five access facts, entry prices, recorded plan limits and the bottom line of each review. The evidence note under the table says how each product was checked.
Side by side
| Metric | AWS Secrets Manager | HCP Vault Dedicated |
|---|---|---|
| What you're paying for | Compliance includedSecrets stored and rotated inside your AWS account, under AWS’s compliance programs, IAM controls and CloudTrail audit trail. | Saves engineering timeVault run for you by HashiCorp: dynamic credentials, rotation and fine-grained policies on a single-tenant cluster you do not operate. |
| Overall score | 7.0Best | 5.2 |
| Free option | Free trial | Free trial |
| Card to start | –Not measured | No card needed |
| Getting access | Self-serve | Self-serve |
| Starter priceCheapest paid plan | $0.40/secret/mo | $0.62/cluster-hour |
| Pricing model | Usage-based | Usage-based |
| Pricing page | Public prices | Public prices |
| Billing unit | Per secret per month and per 10,000 API calls | Per cluster-hour by tier and size, plus per client per month |
| Free option | No free tier of its own; up to $200 of AWS Free Tier credit for new accounts | No free tier; $500 of trial credit for 6 months, no card |
| Machine identities | IAM roles and users, not billed | Billed as clients, like people, at $72.92 a month |
| Audit log retention | CloudTrail event history, 90 days; trails to S3 for longer | 30 days for download from Essentials; none on Development |
| Dynamic secrets | Not offered | Every tier |
| Database rotation | Managed rotation for RDS, Aurora, DocumentDB and Redshift | Every tier (database static roles) |
| Kubernetes | Secrets Store CSI provider (ASCP), EKS add-on | Vault Secrets Operator and CSI provider |
| SAML SSO / SCIM | IAM Identity Center, no extra charge | HCP SAML or OIDC SSO and SCIM, no plan gate stated |
| SOC 2 / ISO 27001 | SOC 1, 2, 3; ISO 27001, 27017, 27018 | Restricted-use SOC 2 report, type not stated; ISO 27001 and 27017 |
| HIPAA BAA | HIPAA-eligible under a BAA with AWS | Not supported |
| EU data storage | Any EU region you choose | EU regions on AWS and Azure; snapshots in the US |
| Self-hosting | Not offered | Vault Community (BSL 1.1); Vault Enterprise through sales |
| Secret export | One secret, or up to 20 per batch call | Per path via CLI or API; no bulk export |
| Bottom line | From its public pages, AWS Secrets Manager is a low-cost, widely certified secrets store for AWS workloads, at $85 a month for our scenario with native database rotation. It has no free tier of its own, no dynamic secrets and no push syncs beyond AWS. | From its public pages, HCP Vault Dedicated puts the most secret-lifecycle features on its entry production tier, with SSO, SCIM and audit streaming self-serve. At $2,245.73 a month it costs the most for our scenario, and it offers no HIPAA BAA or customer-managed keys. |
Evidence: AWS Secrets Manager: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; HCP Vault Dedicated: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run. Prices in USD as listed, excluding tax. "–" means not recorded.
When to pick each
In the words of each review, with the date its facts were checked.
From our HCP Vault Dedicated review
Checked Oct 16, 2026- Pick HCP Vault Dedicated when
- You need dynamic secrets and one Vault across several clouds.
- Pick AWS Secrets Manager when
- Your apps run on AWS and you want $85 a month for the scenario, a HIPAA BAA and customer-managed KMS keys.
Entry price
Baseline: each product's cheapest paid plan, per month. Included usage differs, so read the line under each price.
- AWS Secrets ManagerPay as you go$0.40/secret/moPlus $0.05 per 10,000 API calls; prorated by the hour; replicas billed as secrets
- Managed rotation for RDS, Aurora, DocumentDB and Redshift
- New versions free; AWS managed KMS key free
- No charge for secrets scheduled for deletion
- Volume pricing through AWS sales
- HCP Vault DedicatedDevelopment$0.62/cluster-hourExtra Small, single node; $0.61644 on IBM’s list; up to 25 clients, no per-client fee
- Dynamic and auto-rotating secrets
- No audit logging or secrets sync
- For exploring features in a limited environment
Prices as listed on each pricing page, in USD per month, excluding tax. Observed: AWS Secrets Manager 2026-10-16, HCP Vault Dedicated 2026-10-16.
Which one fits
- If you need to start today without a sales call
- AWS Secrets ManagerSelf-serve sign-up; the highest score of the 2 self-serve products here (7.0/10).
- If you want to try it without entering a card
- HCP Vault DedicatedFree trial, no card needed; scored 5.2/10.
- Lowest starter price
- AWS Secrets Manager$0.40/secret/mo for the Pay as you go (plus $0.05 per 10,000 API calls) plan. HCP Vault Dedicated lists no comparable paid price.
- Highest overall score
- AWS Secrets Manager7.0/10 (Good). The review shows the score breakdown and the run behind it.
Picked by fixed rules from the table above, not by hand. How we score
Full reviews
More in Secrets management
Add a product
Search by product name or by what it does, such as “email” or “feature flags”. 2 more fit in this comparison.