Two different jobs that vendors happily blur, and buying the wrong one is expensive.
A KMS holds cryptographic keys and performs operations with them. You never see the key — you ask the service to encrypt or decrypt, and that boundary is the security property you are paying for. AWS KMS, Google Cloud KMS and Thales CipherTrust are this.
A secrets manager holds strings your application needs to read: database passwords, API tokens, private keys for third-party services. It must hand them over, so the protection is access control, audit and rotation rather than an impenetrable boundary. Doppler and Infisical are this. Vault, OpenBao, Akeyless and Azure Key Vault straddle both, which is convenient and the source of most of the confusion.
Both, plus dynamic credentials that expire on their own.
Both, plus certificates, in a single Azure service.
Ask one question of any tool: does it hand me the secret, or does it do the operation for me? The answer tells you which category it is in, whatever the marketing says.
Tell us which clouds you run in, whether the requirement is keys or secrets or both, and whether a regulator is involved. You get a shortlist and the reasoning behind it. Your details are not passed to vendors.