HashiCorp Vault vs CyberArk Conjur vs cloud KMS and Secrets Manager

If you operate across several environments (your own servers, Kubernetes, one or more clouds) and need dynamic secrets and encryption as a service, HashiCorp Vault is usually the first option to consider. CyberArk Conjur is stronger where application secrets must fit into an existing privileged access management practice. Cloud Secrets Manager and KMS services are simpler and cheaper as long as all of your infrastructure lives with one provider.

What these systems are for

A secrets store replaces passwords and keys hardcoded in code, configuration files and environment variables with a single protected service that offers auditing and access policies. The main criteria used to compare products are:

• storage of static secrets (passwords, tokens, certificates) with versioning;
• dynamic secrets: credentials created on request for a short period;
• encryption as a service, where the application does not own the key;
• authentication of applications and pods (Kubernetes, cloud roles, CI/CD);
• auditing of every access;
• fault tolerance and operation across different environments.

We wrote about why this is needed and how to get started in our article on secrets management. Here we compare three groups of solutions.

HashiCorp Vault

Vault is an identity-oriented system for secrets management and encryption. Clients access resources by paths mounted in Vault, and access is determined by policies. Authentication is possible via tokens, LDAP and third-party providers such as AWS and Azure; all requests, successful and failed, are written to the audit log.

Strengths:

• Dynamic secrets. Vault attaches a lease to each dynamic secret: the secret is valid for a set period and then is revoked automatically. Revocation can also be performed manually, including for an entire group of secrets by prefix, for example during an intrusion.
• Transit — encryption as a service. The application sends data to Vault and receives ciphertext, while the keys stay inside Vault. Key versioning and rotation are supported, along with re-encryption without exposing plaintext, data signing and verification, and HMAC.
• Cloud independence. It runs on your own servers, in Kubernetes and in any cloud.
• A broad ecosystem of integrations for databases, clouds and infrastructure tools.

Limitations: Vault requires operational effort: a well-designed cluster architecture, unsealing procedures, backups and updates. Some capabilities belong to the Enterprise edition.

Licensing: the move to BSL and OpenBao

On August 10, 2023, HashiCorp announced that all future releases of its products would move to the Business Source License. The company states that use is permitted for commercial and non-commercial purposes, except where you offer a "competitive offering" to HashiCorp. The APIs, SDKs and most libraries remain under MPL 2.0. For an end user who uses Vault within their own company, the BSL restriction usually changes nothing, but the legal interpretation of "competitive offering" should be read in HashiCorp's license FAQ, especially if you embed Vault in your own product or service.

In response, OpenBao appeared: a community-driven open fork. The project repository is distributed under MPL-2.0, and the project declares open governance. It describes itself as software for managing, storing and distributing secrets, certificates and keys, with dynamic secrets, leases and revocation. Formally, it is a separate product rather than a commercial version of Vault: features, support and release schedules differ, and they should be compared based on current releases.

In addition, on February 27, 2025, IBM announced the completion of its acquisition of HashiCorp for $6.4 billion. HashiCorp products, including Vault, now belong to IBM; how this will affect licensing policy and the product lineup is best clarified with the vendor.

CyberArk Conjur

Conjur is CyberArk's solution for managing application secrets and identity. There are several options:

• Conjur OSS — the open source version: according to the repository, the server component is distributed under GNU LGPL v3.0, while clients and extensions are under Apache 2.0. It runs in Docker containers with PostgreSQL, uses a role-based policy language, a REST API, and built-in authenticators and rotators. Support is provided by the community.
• Commercial options. CyberArk offers commercial licenses for the Conjur server and a migration guide from the open source version to CyberArk Secrets Manager, Self-Hosted. The cloud option is called Secrets Manager SaaS. CyberArk's feature sets and edition names change, so verify them on the vendor's website.

Strengths: a unified approach to privileged access for people and application secrets, if the company already runs the CyberArk platform; policy-as-code access control; integrations with CI/CD and orchestrators.

Limitations: the set of built-in capabilities, such as encryption as a service and dynamic secrets for databases, should be checked separately against your scenarios compared with Vault. Prices for commercial options are available on request.

Cloud Secrets Manager and KMS

Each major cloud has its own services: AWS Secrets Manager and AWS KMS, Azure Key Vault, Google Secret Manager and Cloud KMS. Their main advantage is that they require no operational effort and are tightly integrated with the provider's roles and services.

As a price reference, using AWS as an example (public rates, subject to change): Secrets Manager costs $0.40 per secret per month and $0.05 per 10,000 API calls; AWS KMS costs $1 per managed key per month, plus requests (the examples on the page show $0.03 per 10,000 symmetric operation requests). For 1,500 secrets and about 900,000 AWS API calls, the page's example gives an estimate of $604.50 per month.

Limitations: vendor lock-in, differing feature sets across clouds, and complexity in hybrid and multi-cloud architectures. For companies whose data must remain on their own servers or in a local data center, cloud services may not meet regulatory requirements or security policy.

Note that KMS and a secrets manager are different things: KMS manages cryptographic keys and operations with them, while Secrets Manager stores arbitrary secrets. Vault combines both roles.

Comparison by criteria

• Environment: Vault — any (on-premise, Kubernetes, multi-cloud); Conjur — on-premise and SaaS, strong integration with CyberArk; cloud services — within a single provider.
• Dynamic secrets: Vault — a mature implementation with leases and revocation; Conjur — verify against your scenarios; cloud services — secret rotation and provider roles.
• Encryption as a service: Vault — Transit; cloud — KMS; Conjur — not its primary purpose.
• Operations: Vault and Conjur require a team; cloud services are managed by the provider.
• License: Vault — BSL (Enterprise — commercial), the OpenBao fork — MPL-2.0; Conjur OSS — LGPL v3, commercial options are paid; cloud — pay-as-you-go.
• Cost: cloud — public rates; Vault Enterprise and CyberArk — on request.

How to choose

1. Define your environment. If everything is in one cloud, start with that cloud's service. For hybrid, multi-cloud or closed-network setups, look at Vault and similar independent solutions.
2. Determine whether you need dynamic secrets and encryption as a service. If so, this is a strong argument for Vault.
3. Consider your existing stack. If CyberArk is deployed for privileged accounts, Conjur can simplify unified management.
4. Assess your operations team. A self-hosted vault is critical infrastructure, and someone must take care of it.
5. Have lawyers check the licensing position, especially if you embed the vault in your own product.
6. Run a pilot on one application: connection, rotation, revocation, auditing.

For applications with dynamically generated credentials and end-to-end encryption, HashiCorp Vault is often the choice. For how to protect secrets within the supply chain itself, see our analysis of the Shai-Hulud incident, where leaked tokens became the worm's distribution channel.

Frequently asked questions

Sources

• HashiCorp: adoption of the Business Source License
• Linuxiac: IBM completes acquisition of HashiCorp
• HashiCorp: License FAQ
• Vault: Transit secrets engine
• Vault: Lease, Renew, and Revoke
• OpenBao: project repository
• CyberArk Conjur OSS: README
• AWS: Secrets Manager pricing
• AWS: KMS pricing