Providers Overview
SecretsManager supports fourteen production-ready providers, each designed for different use cases and environments.
Available Providers
Local encrypted storage using AES-256-GCM. Perfect for development, edge devices, and air-gapped environments.
Learn more →
Azure Key VaultEnterprise-grade secret management with Microsoft Azure. Supports HSM-backed keys and advanced access policies.
Learn more →
ScalewayEuropean cloud provider with GDPR-compliant storage. Competitive pricing and excellent performance.
Learn more →
OVHEuropean cloud provider with GDPR-compliant storage. Secure OAuth-based authentication.
Learn more →Store secrets in your existing PostgreSQL database with optional AES-256-GCM encryption at rest. Simple, self-hosted, and version-tracked.
Learn more →
AWS Secrets ManagerFully managed secret management with IAM integration, automatic rotation, and multi-Region replication.
Learn more →
Oracle VaultEnterprise secret management on Oracle Cloud Infrastructure with native SDK integration and multiple auth modes.
Learn more →Fully managed secret storage with IAM integration, automatic versioning, and seamless ADC authentication.
Learn more →Open-source password manager with end-to-end OpenPGP encryption. Self-hosted, team-oriented, and fully auditable.
Learn more →Alibaba Cloud's fully managed secret management with server-side encryption, automatic rotation, and global regional availability.
Learn more →Tencent Cloud's fully managed secret management with server-side encryption, automatic versioning, and regional availability.
Learn more →Fully managed secret storage with IAM integration, automatic versioning, and seamless authentication.
Learn more →
HashiCorp VaultIndustry-standard secret management with KV v2 versioning, fine-grained policies, and audit logging.
Learn more →Open-source machine identity secrets management with policy-based access control and built-in versioning.
Learn more →Feature Comparison
All providers implement the ISecretProvider interface, but each has unique capabilities:
| Feature | FileSystem | Azure Key Vault | Scaleway | OVH | PostgreSQL | AWS Secrets Manager | Google Cloud Secret Manager | Passbolt | Aliyun KMS | Tencent Cloud | IBM Cloud Secrets Manager | HashiCorp Vault | CyberArk Conjur |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Versioning | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No | Yes | Yes | Yes | Yes | Yes |
| Encryption | AES-256-GCM | HSM-backed | Managed | Managed | AES-256-GCM | AWS KMS | Google Cloud KMS | OpenPGP | KMS-managed | KMS-managed | Managed | Storage-backed | Managed |
| Auth Types | File Permissions | Managed Identity, Service Principal, Azure CLI | API Key, IAM | OAuth | Connection String | IAM, Access Keys, Instance Profile | ADC, Service Account Key | JWT + PGP | AccessKey | AccessKey | IAM | Token, AppRole, OIDC, K8s | API Key |
| Pricing | Free | $0.03 / 10K ops | Free (included) | Free (included) | Self-hosted | $0.40 / secret / month | $0.06 / 10K ops | Free (self-hosted) | Pay-per-use | Pay-per-use | $0.40 / secret / month | Free (self-hosted) | Free (self-hosted) |
| Region Control | Local | Azure Regions | EU (fr-par, nl-ams) | EU (fr-par, nl-ams) | Your infrastructure | AWS Global Regions | Google Cloud Regions | Your server | Alibaba Cloud Global | Tencent Cloud Global | IBM Cloud Global | Your infrastructure | Your infrastructure |
Choose your provider based on your deployment environment, compliance requirements, and budget. You can also use multiple providers in the same application for different secret types.
Choosing a Provider
Use FileSystem when:
- Developing locally and need a simple, zero-configuration solution
- Deploying to edge devices or air-gapped environments
- You need full control over encryption keys and storage
Use Azure Key Vault when:
- Your infrastructure is already on Azure
- You need enterprise features like HSM-backed keys or advanced RBAC
- Compliance requires Azure Government or similar certifications
Use PostgreSQL when:
- You want to use your existing PostgreSQL infrastructure
- You need full control over where secrets are stored (self-hosted)
- You want encrypted secrets without a cloud dependency
- Your team already manages PostgreSQL databases
Use Scaleway when:
- Your data must remain in Europe (GDPR compliance)
- You want competitive pricing compared to major cloud providers
- You're using Scaleway for other infrastructure services
Use OVH when:
- Your data must remain in Europe (GDPR compliance)
- You prefer OAuth-based authentication
- You're using OVH for other infrastructure services
Use AWS Secrets Manager when:
- Your infrastructure is already on AWS
- You need automatic secret rotation for database credentials
- You want fine-grained access control via IAM policies
- You need multi-Region secret replication
Use Oracle Vault when:
- Your infrastructure is already on Oracle Cloud Infrastructure
- You need enterprise-grade secret management with OCI KMS integration
- You prefer config file or instance principal authentication
- You're using Oracle Cloud for other infrastructure services
Use Google Cloud Secret Manager when:
- Your infrastructure is already on Google Cloud
- You want seamless authentication via Application Default Credentials
- You need fine-grained access control via Cloud IAM
- You prefer per-operation pricing over per-secret pricing
Use Passbolt when:
- You want an open-source, self-hosted solution
- Your team needs collaborative password management
- You require end-to-end OpenPGP encryption
- You prefer full control over your secret infrastructure
- You're already using Passbolt for team credential management
Use Aliyun KMS when:
- Your infrastructure is already on Alibaba Cloud
- You need a fully managed secret service with server-side encryption
- You operate in regions where Alibaba Cloud has data centers (Asia-Pacific, Middle East, Europe)
- You want native integration with other Alibaba Cloud services (RDS, ECS, RAM)
Use Tencent Cloud when:
- Your infrastructure is already on Tencent Cloud
- You need a fully managed secret service with server-side encryption
- You operate in regions where Tencent Cloud has data centers (Asia-Pacific, Southeast Asia)
- You want native integration with other Tencent Cloud services (CVM, VPC, CAM)
Use IBM Cloud Secrets Manager when:
- Your infrastructure is already on IBM Cloud
- You need enterprise features like IAM integration and audit logging
- You want fully managed encryption with built-in secret lifecycle management
- You prefer global availability across multiple regions
- You need integration with IBM Cloud Event Notifications
Use HashiCorp Vault when:
- You want a self-hosted, industry-standard secret management solution
- You need built-in KV versioning and dynamic secrets
- You require fine-grained access control policies and audit logging
- You need support for multiple authentication methods (tokens, AppRole, OIDC, Kubernetes)
- Your team already runs Vault in your infrastructure
Use CyberArk Conjur when:
- You want an open-source, self-hosted solution for machine identities and CI/CD pipelines
- You need version-controlled secrets with policy-based privileges
- You want granular, policy-driven access control for hosts and applications
- Your team already runs Conjur in your infrastructure
You can configure multiple providers in the same application. For example, use FileSystem for local development and IBM Cloud Secrets Manager for production by switching based on environment variables.