Every cloud-native pipeline eventually hits the same question: where do the API keys, database passwords, and TLS certificates actually live, and who can rotate them without a 2am page? HashiCorp Vault, AWS Secrets Manager, and Doppler answer that question in three structurally different ways — self-hosted and dynamic, deeply AWS-native, and developer-experience-first SaaS, respectively.
At a Glance
| Tool | Deployment | Dynamic Secrets | Best For |
|---|---|---|---|
| HashiCorp Vault | Self-hosted or HCP Vault Dedicated (managed) | Yes — native, for databases and multiple cloud providers | Platform/security teams needing short-lived, on-demand credentials across heterogeneous infrastructure |
| AWS Secrets Manager | Fully managed AWS service only | Rotation via Lambda; not true on-demand dynamic generation | Teams fully committed to AWS wanting zero infrastructure to run |
| Doppler | Fully managed SaaS (self-hosted available on Enterprise) | Enterprise tier only | Developer-experience-focused teams syncing secrets across many CI/CD and cloud targets |
Short Verdict
Vault is the most capable option and the only one of the three with true on-demand dynamic secrets out of the box, but it costs the most in setup and operational effort unless you buy the managed HCP Vault Dedicated tier. AWS Secrets Manager is the easiest choice if your workloads already live entirely in AWS and you just need rotation and IAM-gated access. Doppler sits in between: it’s not a vault in the cryptographic sense, but it’s the fastest way to get consistent secrets into every CI/CD pipeline and cloud target a team actually uses day to day.
What They Are
HashiCorp Vault is a secrets management and data protection system that can issue short-lived, dynamically generated credentials for databases and cloud providers on request, in addition to storing static secrets, all gated by a policy engine. It can run self-hosted (open source or Enterprise) or as HCP Vault Dedicated, HashiCorp’s managed cluster offering (now sold under IBM).
AWS Secrets Manager is a fully managed AWS service for storing secrets and automating their rotation using a Lambda function you provide (or one of AWS’s built-in rotation templates for RDS, Redshift, and DocumentDB), with access controlled through IAM policies.
Doppler is a SaaS secrets orchestration platform built around syncing one source of truth for environment variables and secrets out to CI/CD systems, cloud providers, and local developer environments, with a strong focus on developer workflow (CLI, config inheritance, change requests) rather than cryptographic primitives.
Pricing Breakdown
| Tool / Tier | Price | Notes |
|---|---|---|
| Vault (self-hosted, open source) | $0 (software) | Business Source License 1.1; you run and operate it yourself |
| HCP Vault Dedicated — Extra Small (Development) | $0.61644/hour | Official IBM-listed hourly rate for the smallest dev cluster |
| HCP Vault Dedicated — Small Cluster | $1.57799/hr (Essentials) or $1.84299/hr (Standard) | Official IBM-listed rate; scales up through Medium and Large cluster sizes |
| HCP Vault Dedicated — Product Client fee | $72.92/month | Per-client charge in addition to cluster hourly rate |
| AWS Secrets Manager | $0.40 per secret per month + $0.05 per 10,000 API calls | Official AWS rate; new AWS customers may apply up to $200 in Free Tier credit |
| Doppler Developer | Free for up to 3 users, then $8/user/month | 25 user cap, 10 projects, 4 environments |
| Doppler Team | $21/user/month | Adds SAML SSO, RBAC, automatic secret rotation, change requests |
| Doppler Enterprise | Custom | Adds dynamic secrets, self-hosting/on-prem option, SCIM, 99.95% SLO |
Dynamic Secrets and Rotation
This is where the three products diverge most. HashiCorp’s own documentation describes dynamic secrets as credentials “generated on demand” by Vault for a target system — a database, a cloud IAM role — and automatically revoked after a defined lease, meaning no static, long-lived credential exists in the first place for an attacker to steal. AWS Secrets Manager’s rotation model is different in kind: it stores a persistent secret and rotates its value on a schedule using a Lambda function (AWS ships ready-made rotation templates for RDS, Redshift, and DocumentDB in its official documentation), but the secret is still a stored, static value between rotations rather than issued fresh per request. Doppler’s own pricing page lists “dynamic secrets” and “automatic secret rotation” as features, but automatic rotation is a Team-tier feature while true dynamic secrets are gated to the Enterprise tier — making Doppler’s dynamic-secrets capability narrower in availability than Vault’s, which ships it in the open-source core.
CI/CD Integration
Vault integrates with CI/CD primarily through its API, CLI, and dedicated plugins (GitHub Actions, GitLab CI, Jenkins) that authenticate a pipeline run and fetch short-lived credentials just for that run. AWS Secrets Manager integrates natively with anything already running under an IAM role or using the AWS SDK — simplest inside AWS-native CI/CD (CodeBuild/CodePipeline) and requires more setup from GitHub Actions or other third-party runners. Doppler is explicitly built around this use case: its Team tier lists CI/CD integration and config syncs as core features, and the CLI is designed to inject secrets as environment variables into almost any pipeline or local shell with minimal configuration, which is the product’s main differentiator against both Vault and Secrets Manager.
Pros / Cons
- Vault pros: true dynamic secrets in the open-source core, broadest feature set, works across any cloud or on-prem environment.
- Vault cons: self-hosted operation is genuinely complex; HCP Vault Dedicated adds both a per-hour cluster charge and a flat per-client fee.
- AWS Secrets Manager pros: zero infrastructure to run, simple per-secret/per-API-call pricing, deep native IAM integration.
- AWS Secrets Manager cons: AWS-only; rotation (not true dynamic generation) requires writing or adopting Lambda functions; per-API-call pricing can add up at high request volumes.
- Doppler pros: best developer experience and CI/CD sync story of the three, generous free tier for small teams, fast setup.
- Doppler cons: true dynamic secrets and self-hosting are Enterprise-only; it’s an orchestration layer over secrets rather than a secrets engine with its own cryptographic backends like Vault’s.
Who It’s a Good Fit For
- Security/platform teams needing on-demand, short-lived credentials across multiple clouds or databases: Vault.
- Teams fully inside AWS wanting the least operational overhead: AWS Secrets Manager.
- Product teams who mainly need one clean source of truth synced into many CI/CD pipelines and clouds, with minimal ops burden: Doppler.
Who Should Look Elsewhere
- Small teams without dedicated platform/security engineers should think twice before self-hosting Vault — the operational overhead is real.
- Multi-cloud or on-prem organizations should look past AWS Secrets Manager, since it only manages AWS-side secrets natively.
- Organizations that need true dynamic, on-demand credential issuance without an Enterprise contract should look past Doppler’s lower tiers toward Vault’s open-source core.
Bottom Line
There isn’t a single winner here because the three products solve different problems: Vault is a secrets engine, AWS Secrets Manager is an AWS-native secrets store with rotation, and Doppler is a developer-experience layer for distributing secrets consistently. Teams that need genuine dynamic, short-lived credentials across heterogeneous infrastructure should default to Vault; teams fully committed to AWS should default to Secrets Manager; teams optimizing for how fast engineers can get secrets into a new pipeline should default to Doppler.
FAQ
What’s the difference between secret rotation and dynamic secrets? Rotation changes the value of an existing, persistent secret on a schedule (AWS Secrets Manager’s model). Dynamic secrets are generated fresh, on demand, with a short lease, and don’t exist as a stored static value at all (Vault’s model).
Is HashiCorp Vault still open source? Vault’s open-source edition is licensed under the Business Source License 1.1, the same license HashiCorp applied across its product line in 2023 — most uses are permitted, but building a competing commercial offering on it is restricted.
Does AWS Secrets Manager support non-AWS secrets? Yes, you can store arbitrary key-value secrets there, but automatic rotation templates and the deepest integrations are built around AWS services like RDS, Redshift, and DocumentDB.
Can Doppler generate dynamic secrets? Only on its Enterprise tier, per Doppler’s own pricing page; automatic rotation (not the same as dynamic generation) is available starting at the Team tier.
What does HCP Vault Dedicated cost beyond the cluster rate? IBM’s official pricing table lists a separate flat “Product Client” fee of $72.92/month in addition to the per-hour cluster charge, which scales with cluster size (Extra Small through Large).
Sources
- IBM — HashiCorp Products Pricing (Vault Dedicated rates)
- HashiCorp Developer Docs — Dynamic Secrets Management
- AWS Secrets Manager — Pricing
- AWS Secrets Manager Docs — Rotation by Lambda Function
- Doppler — Pricing
Discover more from Software Online Review
Subscribe to get the latest posts sent to your email.
