Secret Manager
A managed vault that stores, encrypts, and rotates secrets — API keys, DB credentials, certificates — and serves them to authorized workloads.
Stores the credentials; IAM decides who may read them — the two work together.
Description
The secret vaults (AWS Secrets Manager, GCP Secret Manager, Azure Key Vault) all encrypt secrets at rest, gate access through the provider's IAM, and log retrievals. The differences are in scope and features: Azure Key Vault also manages keys and certificates and offers HSM-backed tiers, AWS Secrets Manager emphasises built-in automatic rotation (with the simpler Parameter Store as an alternative), and GCP Secret Manager focuses on versioned secret storage. They also differ in rotation automation and integration with each cloud's services. To the best of our knowledge the core role is equivalent; choose by the rotation and key/certificate-management features you need.
Capabilities
- Encrypted storage of secrets at rest
- Fine-grained, IAM-gated access
- Automatic rotation of credentials
- Audit logging of every retrieval