How does automatic secret rotation work across clouds?

AWS Secrets Manager provides built-in rotation for RDS, Redshift, and DocumentDB via Lambda rotation functions, plus custom Lambda functions for other secrets. Azure Key Vault does not have built-in rotation — you implement rotation via Event Grid notifications and Functions or use the newer Key Vault certificate auto-rotation. GCP Secret Manager relies on Pub/Sub notifications and Cloud Functions for rotation (no built-in rotation). OCI Vault supports automatic rotation for vault-managed secrets with configurable rotation periods. AWS has the most mature built-in rotation support.

How is pricing structured for secrets management?

AWS Secrets Manager charges $0.40 per secret per month plus $0.05 per 10,000 API calls. Azure Key Vault charges per operation ($0.03 per 10,000 operations for secrets) with no per-secret storage fee. GCP Secret Manager charges $0.06 per active secret version per month plus $0.03 per 10,000 access operations. OCI Vault charges per key version per month ($0.53 for software keys, higher for HSM) with 20 free vault keys. For organizations with many secrets but low API call volume, Azure Key Vault's per-operation model is often cheapest.

Multi-Cloud Secrets Compare

IAM & SecurityMulti-Cloud

Compare secrets management services across AWS, Azure, GCP, and OCI.

Filter Comparison

Category

Showing 20 of 20 features.

Feature	AWS	Azure	GCP	OCI
Service Name Core Features	AWS Secrets Manager	Azure Key Vault	Google Secret Manager	OCI Vault
Secret Types Core Features	API keys, DB credentials, OAuth tokens, arbitrary text/binary	Secrets, keys, certificates in unified vault	Arbitrary string or binary data up to 64 KB	Secrets, master encryption keys, wrapping keys
Max Secret Size Core Features	64 KB per secret value	25 KB per secret value	64 KB per secret version payload	25 KB per secret bundle
Versioning Core Features	Staging labels: AWSCURRENT, AWSPREVIOUS, AWSPENDING	Automatic versioning with unique version identifiers	Immutable versions with enable/disable/destroy states	Secret versions with configurable rotation rules
Replication Core Features	Multi-region secret replication with automatic sync	Geo-replication available in Premium tier	Automatic or user-managed replication policies	Cross-region vault replication
Pricing Model Core Features	$0.40/secret/month + $0.05 per 10K API calls	Per-operation pricing; HSM keys at premium tier rates	Per active secret version + per 10K access operations	Per key-version per month + per 10K operations
Encryption at Rest Security	AWS KMS (AES-256) with customer-managed or AWS-managed CMKs	HSM-backed (FIPS 140-2 Level 2 or Level 3)	Google-managed or CMEK via Cloud KMS (AES-256)	HSM-backed (FIPS 140-2 Level 3) or software-protected
Access Control Security	IAM policies + resource-based policies per secret	RBAC roles or vault access policies; Managed Identity support	IAM roles (secretmanager.secretAccessor, admin, etc.)	IAM policies scoped to compartments and dynamic groups
Audit Logging Security	CloudTrail records all Secrets Manager API calls	Azure Monitor diagnostic logs and Entra ID audit logs	Cloud Audit Logs (Admin Activity and Data Access)	OCI Audit service with 365-day retention
Network Isolation Security	VPC endpoints (PrivateLink) for private access	Private endpoints and service endpoints	VPC Service Controls perimeter support	Private endpoints within VCN subnets
Cross-Account Access Security	Resource-based policies allow cross-account access	Cross-tenant access via RBAC and Lighthouse	IAM bindings support cross-project identities	Cross-tenancy policies with explicit admit statements
Automatic Rotation Operations	Built-in rotation via Lambda functions (RDS, Redshift, DocumentDB native)	Event Grid triggers Azure Functions for rotation	Pub/Sub-based rotation topics with custom handlers	Manual rotation; schedulable via OCI Functions
CLI & SDK Support Operations	AWS SDK (all languages), CLI, CloudFormation, CDK, Terraform	Azure SDK, CLI, ARM templates, Bicep, Terraform	Google Cloud SDK, gcloud CLI, Terraform, client libraries	OCI SDK, CLI, Terraform, Resource Manager
Kubernetes Integration Operations	Secrets Store CSI Driver, External Secrets Operator	Secrets Store CSI Driver with Key Vault provider	Secrets Store CSI Driver, Workload Identity binding	Secrets Store CSI Driver for OKE clusters
CI/CD Integration Operations	CodePipeline, GitHub Actions, Jenkins plugins	Azure DevOps variable groups, GitHub Actions support	Cloud Build integration, GitHub Actions support	OCI DevOps service, external CI/CD via SDK
Database Credential Rotation Integration	Native rotation for RDS, Aurora, Redshift, DocumentDB	Rotation via Functions; no native DB rotation	Custom rotation handler required for all databases	Autonomous DB integration; custom for others
Application Config Integration	AppConfig for feature flags; Secrets Manager for credentials	App Configuration service links to Key Vault references	Berglas helper library; direct SDK access in apps	Config stored as secrets; accessed via SDK or instance metadata
Container Injection Integration	ECS/EKS secret injection via task definitions or CSI driver	AKS pod identity + CSI driver; App Service references	GKE Workload Identity + CSI driver; Cloud Run env vars	OKE secret injection via CSI driver or init containers
Serverless Integration Integration	Lambda environment encryption + Secrets Manager SDK calls	Functions app settings reference Key Vault secrets	Cloud Functions mount secrets as env vars or volumes	OCI Functions access vault secrets via resource principal
Monitoring & Alerts Integration	CloudWatch metrics, EventBridge for secret events	Azure Monitor alerts, Event Grid notifications	Cloud Monitoring metrics, Pub/Sub event notifications	OCI Monitoring alarms, Events service triggers

About This Tool

Every major cloud provider offers a managed secrets management service — AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, and OCI Vault — each with different pricing models, rotation capabilities, access control mechanisms, and integration patterns. Choosing the right service (or understanding them all in a multi-cloud environment) requires comparing features like automatic rotation, versioning, cross-region replication, HSM support, and pricing per secret per version. This comparison tool presents a detailed feature matrix and highlights the key differences that affect architecture decisions.

When to Use This Tool

•Evaluating secrets management services across clouds for a multi-cloud architecture that needs consistent secret handling
•Comparing automatic rotation capabilities and supported secret types (database credentials, API keys, certificates) across providers
•Understanding pricing differences — per-secret vs per-API-call vs combined models — to estimate costs at scale

Frequently Asked Questions

How does automatic secret rotation work across clouds?: AWS Secrets Manager provides built-in rotation for RDS, Redshift, and DocumentDB via Lambda rotation functions, plus custom Lambda functions for other secrets. Azure Key Vault does not have built-in rotation — you implement rotation via Event Grid notifications and Functions or use the newer Key Vault certificate auto-rotation. GCP Secret Manager relies on Pub/Sub notifications and Cloud Functions for rotation (no built-in rotation). OCI Vault supports automatic rotation for vault-managed secrets with configurable rotation periods. AWS has the most mature built-in rotation support.
How is pricing structured for secrets management?: AWS Secrets Manager charges $0.40 per secret per month plus $0.05 per 10,000 API calls. Azure Key Vault charges per operation ($0.03 per 10,000 operations for secrets) with no per-secret storage fee. GCP Secret Manager charges $0.06 per active secret version per month plus $0.03 per 10,000 access operations. OCI Vault charges per key version per month ($0.53 for software keys, higher for HSM) with 20 free vault keys. For organizations with many secrets but low API call volume, Azure Key Vault's per-operation model is often cheapest.

Related Learning Guides

Multi-Cloud Encryption Compare10 min read

Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.