How HashiCorp Vault and AWS KMS differ on scope, key custody, deployment and cost.
| HashiCorp Vault | AWS KMS | |
|---|---|---|
| Type | Secrets platform | Cloud KMS |
| Scope | Secrets, keys, PKI, dynamic credentials | Encryption keys |
| Deployment | Self-hosted + HCP | SaaS (AWS) |
| Key custody | HSM auto-unseal and seal wrap in Enterprise | FIPS 140-3 Level 3 validated HSMs |
| How it works | A secrets engine rather than a key store: it issues short-lived database credentials, cloud tokens and certificates on demand, so secrets expire instead of sitting in a config file. Transit lets it act as an encryption service too. Powerful, and heavy to run properly. | Keys never leave the service — you call it to encrypt and decrypt rather than fetching key material. Envelope encryption is the normal pattern: KMS protects a data key, the data key protects your data. Every AWS service integrates natively, which is most of the value. |
| Pricing* | Community free (BUSL); HCP by quote | $1/key/mo + $0.03 per 10k requests |
| Free tier | Yes | Yes |
| Licence | BUSL-1.1 — not OSI-approved | — |
| Best for | Dynamic, short-lived credentials at scale | Anything already running on AWS |
Choose HashiCorp Vault for dynamic, short-lived credentials at scale. Choose AWS KMS for anything already running on aws.
* Published list pricing (vendor pricing pages, August 2026).