Secrets Management With AWS Secrets Manager and HashiCorp Vault: What a DevOps Engineer Implements in 2026
Secrets stored in .env files and environment variables are the leading cause of production credential incidents. Here is what a DevOps engineer implements using AWS Secrets Manager and HashiCorp Vault.
Taukir katava
As a DevOps Engineer at Acquaint Softtech, a software development partner. The most common credentials incident I encounter in new client engagements is an AWS access key or database password hardcoded in source code or stored as a plain text environment variable in the CI/CD pipeline. Attackers scan GitHub repositories continuously for these patterns. When found, an AWS access key is typically exploited within minutes. A database password in an environment variable is accessible to anyone who can read the running container's configuration. A DevOps engineer replaces this pattern entirely with a managed secrets system. This guide covers what that implementation looks like in practice using AWS Secrets Manager and HashiCorp Vault.
- Engineering teams in the UK, Europe, or US who store database passwords and API keys in .env files, environment variables, or CI/CD pipeline secrets
- SaaS CTOs preparing for a SOC 2 or ISO 27001 audit where secrets management controls are explicitly required
- Teams deploying to Kubernetes who currently store credentials in Kubernetes Secrets (base64-encoded, not encrypted)
- Founders hiring a DevOps engineer and wanting secrets management as part of the security setup brief
The problem with environment variables for secrets is not that they are transmitted insecurely. It are that they are accessible to anything running in the same process, logged inadvertently in error messages, visible in CI/CD pipeline logs, stored in container configuration that can be read by anyone with kubectl exec access, and persisted in version control history when developers accidentally commit .env files. A managed secrets system addresses all of these attack surfaces at once.
For the context on where secrets management fits in the broader DevSecOps pipeline, the DevSecOps 2026 guide covers secrets management as Practice 3 of the 7 DevSecOps practices, alongside SAST, SCA, and the other security controls a DevOps engineer implements.
AWS Secrets Manager vs HashiCorp Vault: When to Use Each
AWS Secrets Manager
Best for: Teams fully on AWS who want managed secrets without self-hosting infrastructure. RDS database credentials, API keys, OAuth tokens for AWS-native applications.
Key features:
Automatic rotation for RDS, Redshift, DocumentDB, and custom secrets.
IAM-based access control: IAM policies define which services can read which secrets.
AWSIRSA for Kubernetes pods (no static credentials in pods).
Secret versioning: previous versions retained for rollback.
Cross-account access: secrets in one AWS account accessible to applications in another.
AWS cost: $0.40/secret/month + $0.05 per 10,000 API calls. Typical SaaS with 20 secrets: $8/month.
Limitation: AWS-only. Not portable to Azure, GCP, or on-premises.
HashiCorp Vault
Best for: Teams on multiple clouds, teams with Kubernetes, teams with complex secret types (PKI certificates, SSH credentials, dynamic database credentials).
Key features:
Dynamic secrets: Vault generates short-lived database credentials on demand.
Each application instance gets its own credential. Automatically revoked on expiry.
PKI secret engine: Vault acts as a Certificate Authority, issuing TLS certificates.
Multi-cloud: integrates with AWS, Azure, GCP, Kubernetes, and on-premises.
AppRole and Kubernetes authentication methods.
Audit log: every secret read and write is recorded with requestor identity.
Hosting options:
HCP Vault (managed): $0 on dev tier, $0.03/hour on starter tier.
Self-hosted on EKS: no licence cost, DevOps engineer time to operate.
Limitation: more complex to set up and operate than AWS Secrets Manager.
What a DevOps Engineer Implements: The 5 Components
Secrets management is not a single configuration. It are 5 interconnected components that together eliminate credentials from code, environment variables, and Kubernetes Secrets.
Component 1: Central Secrets Store (AWS Secrets Manager or Vault) |
A DevOps engineer creates the central secrets store and migrates all existing credentials into it. For AWS Secrets Manager: each secret is created with a descriptive name (prod/database/postgres, prod/stripe/api-key), tagged with the owning service and environment, and assigned an IAM resource policy defining which service roles can read it. |
For Vault: the secret engine (KV v2 for static secrets, database engine for dynamic credentials) is configured, secrets are organised by path (secret/prod/database, secret/prod/stripe), and access policies are defined per application. |
Component 2: Application Integration (SDK or Sidecar) |
Applications read secrets from the central store at startup rather than from environment variables. For AWS Secrets Manager: the AWS SDK call (GetSecretValue) is integrated into the application's configuration loading code. The application IAM role has GetSecretValue permission on the specific secret ARN. |
For Vault with Kubernetes: the Vault Agent Sidecar Injector runs as a sidecar container in each pod and writes secrets to a shared volume. The application reads secrets from the filesystem path rather than calling the Vault API directly. This approach requires no Vault SDK changes to the application code. |
Component 3: External Secrets Operator (for Kubernetes) |
The External Secrets Operator (ESO) is a Kubernetes controller that reads secrets from AWS Secrets Manager or Vault and creates Kubernetes Secrets automatically. A DevOps engineer installs ESO via Helm, configures a SecretStore resource pointing to the secrets backend, and creates ExternalSecret resources that define which external secrets map to which Kubernetes Secrets. |
Benefit: the application continues to read secrets from Kubernetes Secrets (standard pattern, no code changes), but the values are sourced from the managed secrets store and kept in sync. ESO replaces manually managed Kubernetes Secrets entirely. |
Component 4: Automatic Rotation Configuration |
Secrets that do not rotate are permanently compromised once leaked. A DevOps engineer configures automatic rotation for all credentials that support it. |
For AWS Secrets Manager: RDS database passwords are rotated on a configurable schedule (every 30, 60, or 90 days). AWS Secrets Manager calls the rotation Lambda function, which creates a new password in the database, updates the secret, and verifies the new credential works. Applications reading the secret via the SDK automatically get the new value on the next read. |
For Vault dynamic secrets: the database secret engine generates a new database user with a short TTL (e.g. 1 hour) on each request. When the TTL expires, Vault revokes the credential. No rotation is needed because each credential is short-lived by design. |
Component 5: Secrets Scanning in CI/CD Pipeline |
Even with a central secrets store, developers sometimes accidentally commit credentials to source code. A DevOps engineer integrates secrets scanning into the CI/CD pipeline: GitGuardian or TruffleHog scans every commit and pull request for credential patterns (AWS access key format, private key headers, database connection strings). Detected credentials fail the pipeline and alert the security team. |
Pre-commit hooks (using detect-secrets or gitleaks) add a client-side check that catches credentials before they reach the remote repository. This is the last line of defence against accidental credential exposure. |
For the Kubernetes container security layer that sits alongside secrets management, the Kubernetes container security guide covers how IRSA and Workload Identity replace static credentials for pod-level AWS and Azure access alongside the External Secrets Operator approach.
AWS Secrets Manager vs Vault: The Decision Matrix
Both AWS Secrets Manager and HashiCorp Vault are production-grade secrets management solution. The right choice depends on your cloud strategy, infrastructure complexity, and compliance requirements. Here is the honest comparison.
Decision factor | AWS Secrets Manager | HashiCorp Vault |
Cloud strategy | AWS-only deployments | Multi-cloud or hybrid |
Kubernetes secrets (Pods) | IRSA + AWS SDK or ESO | Vault Agent Sidecar or ESO |
Database credential rotation | Built-in Lambda rotation for RDS | Dynamic secrets (short-lived, auto-revoked) |
PKI / TLS certificate management | ACM (separate service) | Vault PKI secret engine (built-in) |
SSH access management | Not supported | Vault SSH secret engine |
Audit logging | CloudTrail for API calls | Vault audit log (every secret access) |
Setup complexity | Low (AWS console + Terraform) | Medium to high (Vault cluster + policies) |
Monthly cost | $0.40/secret/month | HCP Vault or self-hosted (DevOps time) |
SOC 2 / ISO 27001 evidence | CloudTrail + Secrets Manager console | Vault audit log + policy export |
Right for most SaaS | Yes (1-20 services, AWS-native) | Yes (multi-cloud, Kubernetes, complex auth) |
For teams whose first production security incident involved exposed credentials, the production security incident guide covers the credential exposure incident type in detail including the blast radius assessment and incident response procedure.
What It Costs: UK, Europe, and US Teams in 2026
Secrets management implementation is typically part of the broader DevSecOps sprint. Here are the standalone costs at Acquaint Softtech rates compared to in-house options across all markets.
Region / model | In-house DevOps | Eastern Europe agency | Acquaint Softtech ($22/hr) |
UK | GBP 80,000-110,000/yr | GBP 60-80/hr | $22/hour | $3,200/month |
Germany / DACH | EUR 90,000-120,000/yr | EUR 70-90/hr | $22/hour | $3,200/month |
Netherlands / Benelux | EUR 85,000-115,000/yr | EUR 65-85/hr | $22/hour | $3,200/month |
France / Southern EU | EUR 70,000-100,000/yr | EUR 55-75/hr | $22/hour | $3,200/month |
US | $130,000-180,000/yr | $80-110/hr | $22/hour | $3,200/month |
Secrets management scope | Cost at $22/hour | What is delivered |
AWS Secrets Manager setup (5-15 secrets) | 2 to 3 days: $352 to $528 | SecretStore creation, IAM policies, application SDK integration, ESO for Kubernetes |
AWS Secrets Manager + RDS rotation | 3 to 4 days: $528 to $704 | Full setup + automatic RDS password rotation Lambda, rotation schedule, verification |
HashiCorp Vault on EKS (HCP or self-hosted) | 4 to 7 days: $704 to $1,232 | Vault setup, secret engines, AppRole/Kubernetes auth, policies, Vault Agent Sidecar |
External Secrets Operator for Kubernetes | 1 to 2 days: $176 to $352 | ESO installed, SecretStore configured, ExternalSecret resources per service |
Secrets scanning in CI/CD (GitGuardian + pre-commit) | 1 to 2 days: $176 to $352 | GitGuardian integration, pre-commit hooks, historical repo scan, findings remediation |
Full secrets management stack (all 5 components) | 8 to 14 days: $1,408 to $2,464 | Complete: central store, app integration, ESO, rotation, scanning |
Monthly retainer (secrets + DevSecOps) | $3,200/month | Ongoing: secret rotation monitoring, new service onboarding, rotation failures, audits |
Acquaint Softtech's hire DevOps developers service provides pre-vetted engineers with AWS Secrets Manager, HashiCorp Vault, and External Secrets Operator production experience. Starting at $22/hour or $3,200/month.
For the full DevOps rate comparison across the UK, Europe, and US, the DevOps engineer cost guide covers what each price tier delivers for each market.
For the EKS cluster where the External Secrets Operator and Vault Agent run, the AWS EKS setup and management guide covers the cluster setup including IRSA configuration for secrets access.
Individual DevOps engineer on a monthly retainer through our staff augmentation model. Starting at $22/hour or $3,200/month. Available in 48 hours.
Frequently Asked Questions
-
What is secrets management in DevOps?
Secrets management is the practice of storing, accessing, rotating, and auditing application credentials (database passwords, API keys, TLS certificates) in a dedicated secure system rather than in environment variables, .env files, or source code. A DevOps engineer implements a central secrets store (AWS Secrets Manager or HashiCorp Vault), integrates it with the application and Kubernetes, configures automatic rotation, and adds secrets scanning to the CI/CD pipeline.
-
What is the difference between AWS Secrets Manager and HashiCorp Vault?
AWS Secrets Manager is an AWS-native managed service, simpler to set up, with built-in RDS rotation and IAM-based access control. Best for AWS-only teams. HashiCorp Vault is open-source and multi-cloud, supports dynamic secrets (short-lived credentials), PKI certificate management, and SSH credentials. More complex to operate but more powerful for multi-cloud or Kubernetes-heavy environments.
-
What is the External Secrets Operator for Kubernetes?
The External Secrets Operator (ESO) is a Kubernetes controller that reads secrets from AWS Secrets Manager or Vault and automatically creates and updates Kubernetes Secrets. Applications continue reading from Kubernetes Secrets (no code changes), but the values are managed in the external secrets store. ESO replaces manually maintained Kubernetes Secrets with automatically synced values from a secure, auditable store.
-
How does AWS Secrets Manager automatic rotation work?
For RDS databases, AWS Secrets Manager runs a Lambda function on a configured schedule (e.g. every 30 days). The Lambda creates a new password in the database, updates the secret value, and verifies the new credential works. Applications using the AWS SDK to read the secret automatically get the new value on the next call. No application restart is required.
-
What are HashiCorp Vault dynamic secrets and why do they matter?
Vault dynamic secrets generate a new credential on demand with a short TTL (time-to-live). For database access, Vault creates a new database user, grants it the required permissions, and returns the credentials. When the TTL expires, Vault revokes the user. Each application instance gets its own short-lived credential. Even if a credential is leaked, it expires within hours. This is significantly more secure than a static password that rotates every 30 days.
-
How much does secrets management cost to implement in the UK or Europe?
At Acquaint Softtech ($22/hour), a full secrets management stack (all 5 components) takes 8 to 14 days, costing $1,408 to $2,464. Compared to a UK in-house engineer at GBP 80,000 to 110,000 per year, or a German/Dutch engineer at EUR 85,000 to 120,000 per year, the implementation cost is recovered within the first week of the annual salary comparison.
-
Does secrets management satisfy SOC 2 access control requirements?
Yes. Secrets management directly addresses SOC 2 CC6.1 (logical access security) and CC6.6 (transmission protection). Evidence includes: Secrets Manager or Vault audit logs showing which service accessed which secret and when, IAM or Vault policies showing least-privilege secret access, rotation schedule configuration showing credentials are rotated on a defined schedule, and secrets scanning pipeline results showing no credentials in source code.
Taukir Katava is a DevOps Engineer at Acquaint Softtech with 4+ years of experience across AWS, Azure, and GCP. He specialises in Kubernetes cluster administration, CI/CD pipeline automation, and cloud infrastructure design for high-traffic platforms. Taukir writes about the practical side of production DevOps: what infrastructure decisions cost and what they actually deliver.
Table of Contents
Get Started with Acquaint Softtech
- 13+ Years Delivering Software Excellence
- 1300+ Projects Delivered With Precision
- Official Laravel & Laravel News Partner
- Official Statamic Partner
Related Reading
Cloud Infrastructure Cost Optimisation: What a DevOps Engineer Saves You in the First 90 Days
Cloud infrastructure waste accumulates silently across 8 categories. Here is what a DevOps engineer audits, what they fix first, and what savings look like across a 90-day engagement in 2026.
Taukir katava
May 19, 2026
DevOps Staff Augmentation vs Dedicated DevOps Team: Which Model Fits Your Stage in 2026?
Staff augmentation gives you one DevOps engineer embedded in your team. A dedicated DevOps team gives you a managed function. Here is the honest comparison and when each model is right.
Ahmed Ginani
June 4, 2026
Azure AKS Setup and Management: What a DevOps Engineer Delivers for Azure Workloads in 2026
Azure AKS is the right Kubernetes service for .NET stacks and Microsoft ecosystem companies. Here is what a DevOps engineer sets up, manages ongoing, and what it costs in 2026.
Taukir katava
June 11, 2026India (Head Office)
203/204, Shapath-II, Near Silver Leaf Hotel, Opp. Rajpath Club, SG Highway, Ahmedabad-380054, Gujarat
USA
7838 Camino Cielo St, Highland, CA 92346
UK
The Powerhouse, 21 Woodthorpe Road, Ashford, England, TW15 2RP
New Zealand
42 Exler Place, Avondale, Auckland 0600, New Zealand
Canada
141 Skyview Bay NE , Calgary, Alberta, T3N 2K6