Secrets Management: HashiCorp Vault and AWS Secrets Manager for Dev Teams

Secrets management is the practice of securely storing, accessing, distributing, and rotating sensitive credentials — API keys, database passwords, encryption keys, tokens, certificates, and other secrets — using dedicated tooling instead of hardcoding them in source code, environment variables, or configuration files. HashiCorp Vault and AWS Secrets Manager are the two most widely adopted solutions in 2026, each suited to different organisational sizes and cloud strategies. For Indian development teams building SaaS products, fintech applications, or enterprise software, proper secrets management prevents the most common cause of data breaches: exposed credentials.

Last updated October 2026

Why Is Secrets Management Critical for Indian Dev Teams?

The problem is startlingly common. GitHub’s own scanning reveals millions of secrets accidentally committed to public repositories every year. Indian startups — often moving fast with small teams — are particularly vulnerable:

• Hardcoded AWS keys in code: A developer commits AWS_SECRET_ACCESS_KEY to a public GitHub repo. Automated bots detect it within minutes and spin up crypto-mining EC2 instances. The startup gets a ₹5–15 lakh AWS bill.
• Database passwords in .env files: The .env file is accidentally included in a Docker image pushed to Docker Hub. Anyone who pulls the image has production database access.
• API keys shared via Slack: Razorpay, Stripe, or Twilio API keys shared in a Slack channel remain searchable forever. If any team member’s Slack account is compromised, all shared secrets are exposed.
• No rotation: The same MySQL root password has been used since the project started two years ago. Former employees, contractors, and anyone who ever had access still knows it.

Secrets management tools solve all of these problems by centralising secrets in an encrypted vault, controlling access through policies, auditing every read/write, and automating rotation.

HashiCorp Vault: Enterprise-Grade Secrets Management

Vault is an open-source (with enterprise tier) secrets management platform that supports every cloud provider, on-premise infrastructure, and hybrid environments. Key capabilities:

• Secret engines: KV (key-value store for static secrets), database (generates dynamic, short-lived credentials for MySQL, PostgreSQL, MongoDB), AWS/Azure/GCP (generates temporary cloud credentials), PKI (issues TLS certificates), SSH (provides signed SSH keys).
• Dynamic secrets: Instead of storing a permanent database password, Vault generates a new credential on every request with a configurable TTL (time-to-live). When the TTL expires, Vault automatically revokes the credential. An attacker who intercepts a dynamic secret has a credential that expires in minutes or hours.
• Access policies: Define who (human or machine) can access which secrets. Policies use path-based rules: path "secret/data/production/database/*" { capabilities = ["read"] } allows read-only access to production database secrets.
• Audit logging: Every secret access is logged with timestamp, identity, path, and operation. Essential for DPDP Act compliance and incident investigation.
• Encryption as a service: Vault’s Transit engine encrypts data without exposing the encryption key. Applications send plaintext, receive ciphertext, and never handle keys directly.

Deployment options for Indian teams:

• Self-hosted open-source: Free. Run on your own servers or Kubernetes cluster. Requires operational expertise for high availability, unsealing, and backup.
• HCP Vault (HashiCorp Cloud Platform): Managed service starting at approximately $0.03/hour (~₹2,200/month for a development cluster). Reduces operational burden significantly.
• Vault Enterprise: For large organisations needing namespaces, replication, and compliance features. Pricing is custom, typically ₹5–15 lakh/year.

AWS Secrets Manager: Native AWS Integration

If your infrastructure runs primarily on AWS (common for Indian startups and enterprises), AWS Secrets Manager offers tight integration with minimal setup:

• Automatic rotation: Built-in Lambda functions rotate RDS database credentials, Redshift credentials, and API keys on a schedule. No custom code needed for supported services.
• IAM-based access control: Use AWS IAM policies and resource policies to control which Lambda functions, EC2 instances, ECS tasks, or users can access specific secrets.
• Cross-region replication: Replicate secrets to multiple AWS regions for disaster recovery. Relevant for Indian businesses with infrastructure in Mumbai (ap-south-1) and Singapore (ap-southeast-1).
• Pricing: $0.40 per secret per month (~₹33) plus $0.05 per 10,000 API calls. For a team managing 50 secrets, the cost is approximately ₹1,650/month — significantly cheaper than self-hosted Vault when operational costs are included.

Vault vs AWS Secrets Manager: Which Should You Choose?

• Choose AWS Secrets Manager if: You are AWS-only or AWS-primary, your team is small (under 20 developers), you want minimal operational overhead, and your secrets are mostly database credentials and API keys.
• Choose HashiCorp Vault if: You use multi-cloud or hybrid infrastructure, you need dynamic secrets and encryption-as-a-service, you have compliance requirements needing detailed audit trails, or you want to avoid vendor lock-in.
• Use both: Many Indian enterprises use AWS Secrets Manager for AWS-native services and Vault for application-level secrets, cross-cloud scenarios, and PKI infrastructure.

CI/CD Integration Best Practices

Secrets must flow securely into your CI/CD pipeline without being exposed in logs, environment variables, or build artifacts:

• GitHub Actions: Use the hashicorp/vault-action to fetch secrets from Vault, or native aws-actions/configure-aws-credentials for AWS Secrets Manager. Secrets are injected as masked environment variables — GitHub automatically redacts them from logs.
• GitLab CI: Use Vault integration (native in GitLab Premium) or external secrets operator for Kubernetes. GitLab CI/CD variables should reference Vault paths, not contain actual secrets.
• Jenkins: Use the HashiCorp Vault plugin to inject secrets into build steps. Secrets are available only during the build and are not persisted to disk.
• Docker and Kubernetes: Use the Vault Agent Injector (sidecar container) to inject secrets into pod environments at runtime. Alternatively, use the External Secrets Operator to sync AWS Secrets Manager into Kubernetes secrets.

At The MAD, our development and cyber security teams implement secrets management for Indian businesses transitioning from ad-hoc credential handling to structured, auditable systems. We have deployed Vault clusters and AWS Secrets Manager configurations for fintech startups, healthcare applications, and ecommerce platforms. Implementation projects typically cost ₹1.5–5 lakh depending on complexity.

Frequently Asked Questions

Can I use .env files if I add them to .gitignore?

Using .gitignore is the bare minimum but not sufficient. .env files can still be accidentally committed, included in Docker images, exposed in crash dumps, or read by any process on the server. Use a secrets manager for production; .env files are acceptable only for local development with non-sensitive test values.

How often should secrets be rotated?

Follow the principle of least privilege and shortest practical lifetime. Database passwords: every 30–90 days. API keys: every 90 days or immediately if compromised. Dynamic secrets from Vault: TTL of 1–24 hours for automated systems. TLS certificates: before expiry (automate with Vault PKI or Let’s Encrypt).

What happens if HashiCorp Vault goes down?

Applications cache their last-fetched secrets for a configurable TTL, so a brief Vault outage does not cause immediate failures. For high availability, deploy Vault in a multi-node cluster (minimum 3 nodes for Raft consensus) with automatic unsealing via AWS KMS or Azure Key Vault.

Is AWS Secrets Manager compliant with Indian data protection laws?

AWS Mumbai region (ap-south-1) stores data within India. AWS is compliant with SOC 2, ISO 27001, and provides a DPDP Act compliance framework. Ensure your secrets are stored in the Mumbai region if data residency is a requirement.

How do I migrate existing hardcoded secrets to a secrets manager?

Phase the migration: (1) Inventory all secrets in code, config files, and CI/CD variables. (2) Import them into Vault or AWS Secrets Manager. (3) Update application code to fetch from the secrets manager instead of reading from config. (4) Remove hardcoded secrets from code and rotate every credential that was previously exposed. (5) Add pre-commit hooks (like git-secrets or gitleaks) to prevent future commits of secrets.