HashiCorp Vault

Vault has a free community edition alongside a paid Enterprise tier with features like disaster recovery replication. Note that HashiCorp shifted its licensing from MPL 2.0 to the Business Source License (BUSL) in 2023, which led the Linux Foundation to back a fork called OpenBao; HashiCorp itself was later acquired by IBM in a deal completed in early 2025.

Dynamic secrets are credentials Vault generates on demand, such as short-lived database usernames and passwords or cloud IAM keys, each with a lease and TTL. Because they expire and are revoked automatically, they eliminate the sprawling reuse of long-lived API keys and passwords.

Vault is platform-agnostic, runs self-hosted or as managed HCP Vault, and offers dozens of secret engines covering databases, PKI, and encryption-as-a-service. AWS Secrets Manager is simpler and tightly integrated with IAM if your entire stack already lives in AWS, but it is far less portable across clouds.

Use a clustered deployment with integrated Raft storage or Consul as the backend, enable TLS everywhere, and configure auto-unseal via a cloud KMS. Running vault operator init generates five unseal key shares with a default threshold of three, which you must distribute securely, plus an initial root token that should be revoked after setup.