AWS Secrets Manager

AWSSecurity

Fully managed service to store, rotate, and audit secrets such as database credentials, API keys, and OAuth tokens with native rotation Lambda integrations for RDS, Redshift, and DocumentDB

Jurisdictional exposure

Provider HQ
USSeattle, USA

Subject to CLOUD Act, FISA-702, DPF

Region locations
APACCNEEAEUUKUSOther39 regions across 7 jurisdictions
Sovereign option
Yes — 5 sovereign-flagged regions available

Attributes

SLA Uptime
99.9%
Encryption
Yes
Multi Region
Yes

Sub-services (3)

Secrets

Versioned encrypted secret values stored under a resource ARN

Automatic Rotation

Lambda-driven rotation schedules for database and custom secrets

Multi-Region Replication

Primary/replica replication of secrets across AWS regions

Compliance & Certifications

This service is attested for the following frameworks. Always verify with the provider before relying on a specific compliance posture.

Where this runs

39 regions
28 countries
5sovereign
Sovereign regions (5)
  • AWS European Sovereign Cloud (Germany) · BrandenburgAWS European Sovereign Cloud
  • AWS GovCloud (US-East) · AshburnAWS GovCloud (US)
  • AWS GovCloud (US-West) · HillsboroAWS GovCloud (US)
  • China (Beijing) · BeijingAWS China (Sinnet)
  • China (Ningxia) · YinchuanAWS China (NWCD)
Commercial regions (34)

Europe (8)

  • Europe (Paris)
  • Europe (Frankfurt)
  • Europe (Ireland)
  • Europe (Milan)
  • Europe (Spain)
  • Europe (Stockholm)
  • Europe (Zurich)
  • Europe (London)

North America (7)

  • Canada West (Calgary)
  • Canada (Central)
  • Mexico (Central)
  • US East (N. Virginia)
  • US West (Oregon)
  • US East (Ohio)
  • US West (N. California)

South America (1)

  • South America (São Paulo)

Asia (11)

  • Asia Pacific (Hong Kong)
  • Asia Pacific (Hyderabad)
  • Asia Pacific (Mumbai)
  • Asia Pacific (Jakarta)
  • Asia Pacific (Osaka)
  • Asia Pacific (Tokyo)
  • Asia Pacific (Malaysia)
  • Asia Pacific (Singapore)
  • Asia Pacific (Seoul)
  • Asia Pacific (Taipei)
  • Asia Pacific (Thailand)

Oceania (3)

  • Asia Pacific (Melbourne)
  • Asia Pacific (Sydney)
  • Asia Pacific (New Zealand)

Middle East (3)

  • Middle East (Bahrain)
  • Israel (Tel Aviv)
  • Middle East (UAE)

Africa (1)

  • Africa (Cape Town)

Tags

Equivalent services on other platforms

Key Management ServiceAlibaba

Managed key and secrets service with software and hardware-backed (HSM) key management, envelope encryption for Alibaba Cloud services, automatic rotation and dedicated KMS instances

Azure Key VaultAzure

Centralised vault for cryptographic keys, secrets, and certificates with HSM-backed keys, managed certificate renewal, and RBAC or access-policy enforcement

Bleu Key VaultBleu

Managed key, secret and certificate store: Azure Key Vault operated by Bleu from data centres located exclusively in France, keeping keys within the Bleu perimeter.

Secret ManagerGCP

Fully managed secret storage with automatic replication across regions, VPC Service Controls integration, CMEK encryption, version history, per-secret IAM, and rotation via Cloud Scheduler plus Cloud Run hooks — used by GKE, Cloud Run, and Compute Engine workloads

Huawei Data Encryption Workshop (DEW)Huawei

Unified cryptographic services including Key Management Service for envelope encryption, Cloud Secret Management Service for secret storage and rotation, Key Pair Service for SSH key management, and Dedicated HSM for FIPS 140-2 Level 3 workloads

IBM Cloud Secrets ManagerIBM

Centralised management of API keys, credentials, certificates and other secrets with dynamic secrets, rotation and IAM-based access control

NumSpot Managed Secret ManagerNumSpot

Managed secrets store for credentials, keys and other sensitive configuration on NumSpot's sovereign platform; SecNumCloud PaaS qualification in progress (J0/J1 passed May 2026)

OpenStack BarbicanOpenStack

Key management service for symmetric and asymmetric keys, certificates, and other secret material — pluggable backends include software KMS, HSM via PKCS#11, Vault, and KMIP-compliant appliances. Equivalent to AWS KMS / Azure Key Vault / Cloud KMS in the cross-provider mapping

OCI VaultOracle

Centralised key and secret management service with HSM-backed symmetric and asymmetric keys, automatic rotation, and envelope encryption for OCI resources

OVHcloud Secret ManagerOVHcloud

Managed secrets vault with a REST API and HashiCorp Vault KV2-compatible API. It has native OVHcloud IAM integration, audit logs via Logs Data Platform, and is billed per secret version per month.

Scaleway Secret ManagerScaleway

Encrypted storage for application secrets (API keys, database credentials, certificates) with versioning, rotation, and access-control via IAM policies

STACKIT Secrets ManagerSTACKIT

Vault-compatible encrypted storage for application secrets (API keys, credentials, certificates) with per-secret versioning and access control via ACLs and AppRole authentication

Pricing

Pricing model:pay-as-you-go