Alright, let's cut through the marketing fluff. We're about to roll out a 50-microservice Kubernetes cluster, and secrets management is non-negotiable. The team is split between "just use AWS Secrets Manager" and "we need the control of HashiCorp Vault."
I'm inherently skeptical of vendor lock-in, but I'm also skeptical of the operational overhead of running our own Vault cluster. Before we commit to either, I need a real cost/benefit breakdown, not feature lists.
My initial napkin math for AWS Secrets Manager:
* **~1000 secrets** (20 per service, some shared).
* **~$0.40 per secret per month**.
* That's **$400/month** baseline, just to store them. API calls ($0.05 per 10k) for frequent rotation/pulls will add more.
* The argument is "it's just there," integrated with IAM, and has RDS integration built-in.
For Vault (self-hosted on ECS/EKS):
* **Software is "free"** (open source), but compute/storage isn't.
* Need a **3-node cluster for HA** (c5.large instances? ~$150/month).
* Plus the **operational toil**: patching, scaling, backup/DR, auditing log shipping.
* The "control" argument: dynamic secrets for databases, more flexible policies, no egress costs for internal calls.
Where I need the community's real-world experience:
* What's the **true TCO** for a production Vault setup? Am I missing hidden costs?
* Has anyone done a **break-even analysis** on when Vault's lack of per-secret pricing outweighs its ops burden?
* For a team that's already AWS-native, is the flexibility of Vault worth the **architectural debt** of another stateful service to manage?
* Any horror stories with either at scale, especially around K8s integrations or secret rotation latency?
Show me the numbers, not the sales deck.
-auditor
Show me the bill
I run a platform engineering team for a 200-dev SaaS company, and we migrated from AWS Secrets Manager to self-hosted Vault on our EKS cluster about 18 months ago to manage secrets for a similar scale of workloads. We now run about 70 services.
Our breakdown from living with both:
- **True Cost:** AWS Secrets Manager's monthly bill is the floor, not the ceiling. At your scale, the API call costs for service pulls become real, especially if you're not caching aggressively. Our bill was growing predictably at about $550/month and rising with services. Vault's cost is team time. A 3-node cluster on c5.large (~$150/month) is accurate, but you'll spend 2-4 engineering days quarterly on maintenance (upgrades, monitoring checks, tuning). For us, the OpEx trade for CapEx control was worth it.
- **Operational Model:** The "it's just there" of AWS is its biggest win. IAM integration is effortless. Vault needs you to be a Vault admin; you're now running a security-critical, stateful service that needs sealing/unsealing automation, secure backup, and audit log aggregation. If your team lacks appetite for that, it's a massive tax. We use the vault-secrets-operator for K8s, and it adds another layer to debug.
- **Secret Dynamism:** This is Vault's knockout feature. For database credentials, Vault can generate short-lived users per pod. This is a genuine security uplift we couldn't get with AWS. AWS has some rotation Lambda integrations, but they're clunky by comparison. If you have many services needing short-lived DB creds, Vault changes the game.
- **Ecosystem Lock-in:** AWS locks you into AWS. Vault locks you into... being a Vault operator. With Vault, your patterns (policies, auth methods) are portable to other clouds or on-prem. For a purely AWS-native stack that will never leave, the AWS lock-in is less of a concern. For us, having multi-cloud escape velocity mattered.
My pick: Go with **Vault**, but only if you have a dedicated platform/infra team that can own the operational burden and treat it as a product. Its power for dynamic secrets and policy flexibility is real. If this is a DevOps-light shop where the app team also manages infra, choose **AWS Secrets Manager**; the set-it-and-forget-it integration is worth the premium for reduced cognitive load.
To make it crystal clear, tell us: 1) Do you have a platform team to own this, and 2) How many of those 1000 secrets are static API keys vs. database passwords you'd rotate frequently?
Automate all the things
Your point about Vault's operational model being a fundamental shift is critical. It's not just about running another service; you're adopting a new security boundary with its own authentication, authorization, and audit lifecycle. The `vault-secrets-operator` simplifies the Kubernetes workflow, but it merely moves the complexity. You now manage CRDs, operator upgrades, and secret rotation synchronization, trading AWS API calls for a more intricate control plane.
On cost, I'd refine the engineering time estimate. Initial quarterly maintenance might be 2-4 days, but that assumes stable, greenfield deployments. Our experience introduced variable overhead from events like storage backend I/O tuning during peak secret fetching, or investigating occasional lease renewal spikes in the metrics. The true operational cost converges on your team's tolerance for managing a stateful, security-critical data store versus a managed API.
Your napkin math is missing the biggest line item for AWS Secrets Manager. You're quoting the $0.40 per secret per month, but that's for the *standard* tier, which is limited to *one version* of the secret. You need the *advanced* tier ($0.60/secret/month) for automated rotation and versioning support. So your baseline is closer to $600/month before a single API call. HashiCorp's licensing might be a pain, but at least their math isn't hidden behind tier names.
Anecdotes aren't data.