Skip to content
inetGeek

AWS Secrets Manager vs Infisical

SEPT 2026 audit

A comparison of AWS Secrets Manager and Infisical built from values read directly from each provider's own documentation, with the source recorded against every figure.

Reviewed by Palash BagchiUpdated 22 criteria comparedSources last checked

The short answer

Choose AWS Secrets Manager if…

Teams already deep in AWS IAM, Lambda and RDS — the integration is native rather than bolted on, and the per-secret price is simple to reason about.

Editorial · Palash Bagchi · approved

Choose Infisical if…

Teams that want per-identity pricing that treats a machine credential the same as a human one, or that value the option to self-host the same open-source engine the cloud product runs.

Editorial · Palash Bagchi · approved

Consider something else if…

  • AWS Secrets Manager: Secrets sprawl across many small values rather than a few large ones — at $0.40/secret/month, a service charging per identity or per seat instead can work out cheaper for a team with a handful of engineers and hundreds of individual secrets.
  • Infisical: Dynamic secrets are needed immediately — that's an Advanced-tier feature here, two tiers above the entry paid plan.

Neither quite fits? Every other option, ranked by iScore: AWS Secrets Manager alternatives · Infisical alternatives

17 sourced criteria separate them — see where, with sources, below.

Visit AWS Secrets Manager documentationVisit Infisical documentation

No affiliate links, sponsored placements or paid rankings appear on this site. Ordering follows the sourced data and the stated criteria.

01.

At a glance.

CriterionAWS Secrets ManagerInfisical
Pricing
Free tier
No
Yes
Kind of free offerIntroductory free tierFree tier
What the free plan includesUp to $200 of AWS Free Tier credits for new customers, and a free plan chosen at sign-up that lasts 6 months. Neither is a standing Secrets Manager allowance.A free plan for individuals and personal projects; every paid plan additionally carries a free trial with no credit card.
Entry paid plan$0.40 per secret per month, plus $0.05 per 10,000 API calls.Pro tier: $20/identity/month billed annually, or $23/identity/month billed monthly.
Pricing modelPer-secret monthly fee plus metered API calls. Rotating a secret creates a new version but is not separately charged beyond the API calls it makes.Billed per identity per month. An identity is any principal that authenticates to Infisical, human or machine.
Infrastructure
Regions
34 commercial AWS Regions plus 2 AWS GovCloud (US) Regions listed in the Secrets Manager service endpoints table.
Infisical Cloud runs in two regions: US (us.infisical.com or app.infisical.com) and EU (eu.infisical.com), each in its own AWS account
Uptime SLA
99.99% monthly uptime, one figure with no configuration split.
The SLA's own wording disagrees with itself: "ninety-nine and nine tenths percent (99.99%)" spells 99.9 and prints 99.99. Either way it applies only to Enterprise tier and above.
Auth
Audit logsAWS CloudTrail records every Secrets Manager API call as an event; the last 90 days are viewable in the CloudTrail console, longer retention by creating a trail that delivers to S3.None on Free. 30-day retention on Pro, 90-day on Advanced, custom retention on Enterprise.
Secrets
Secret versioningSupported — rotating a secret automatically creates a new version, at no additional per-secret charge.Not included on the free tier. Included from Pro: secret versioning and point-in-time recovery.
Compliance
SOC 2Listed as SOC-compliant on AWS's own compliance scope page.SOC 2 Type 2 report listed in Infisical's Trust Center; access by request.
HIPAAListed as a HIPAA-eligible service on AWS's own reference page.HIPAA listed under Compliance in Infisical's Trust Center, alongside SOC 2 and FIPS 140-3. DPA requires an executed BAA before PHI is submitted.
GDPR / data residency
Customers choose the geographic Region their data is stored in; AWS states all AWS services can process personal data in compliance with the GDPR. AWS-wide GDPR statement, not a Secrets Manager-specific page.
DPA covers EU GDPR, UK GDPR and the Swiss FADP, using the SCCs, UK Addendum or Swiss modifications for transfers out of the EEA, UK or Switzerland.
PCI DSS
Attestation of Compliance for PCI DSS version 3.2 at Service Provider Level 1; can be used for cardholder-data workloads.
Payment card information subject to PCI DSS is Restricted Data customers may not submit without express prior written agreement.
Encryption at restEnvelope encryption: each secret value is encrypted with a unique 256-bit AES data key, itself encrypted under an AWS KMS key.Secrets and sensitive data encrypted with AES-256-GCM before being persisted to the storage backend.
Customer-managed keysAny symmetric-encryption customer managed KMS key in the same account and Region can encrypt a secret, instead of the aws/secretsmanager AWS managed key. Asymmetric KMS keys are not supported; keys are chosen per secret.A project can be encrypted with an external KMS — AWS KMS or GCP KMS — instead of Infisical's internal KMS.
Role-based access controlIAM identity-based and resource-based policies define who can take which actions on which secrets; attribute-based access control (ABAC) is also supported.Role-based, attribute-based, and one-off additional-privilege resource constraints.
Private networking / VPCInterface VPC endpoints powered by AWS PrivateLink reach the Secrets Manager API with no internet gateway; traffic does not leave the AWS network.Gateways run inside your own network so Infisical can reach private resources; a paid feature under the Enterprise Tier for Infisical Cloud.

Only criteria both providers publish appear here; a tinted cell marks a real difference. Criteria only one of them documents are listed below, and an absence there means we found no source — not that the feature is missing. How we source this.

The small bar above a value is inetGeek's own lean toward that side — computed from the same facts shown, never a number the provider published. See the picker below "The short answer" to weigh only the criteria you care about.

02.

Where they differ.

Free tier

AWS Secrets Manager
No
Infisical
Yes
Sources (2) →

Kind of free offer

AWS Secrets Manager
Introductory free tier
Infisical
Free tier
Sources (2) →
  • AWS Secrets Manager Pricing ↗

    “At account sign-up, you can choose between a free plan and a paid plan. The free plan will be available for 6 months after account creation.”

    Read 2026-09-13 · official pricing · Report a correction

  • Infisical Pricing ↗

    “Get started with: 5 identities, unlimited projects 100+ integrations Agent Proxy Secret Sharing Secret References and Imports Secret Overrides 2FA Unlimited Projects (separate from 5 identities)”

    Read 2026-09-14 · official pricing · Report a correction

What the free plan includes

AWS Secrets Manager
Up to $200 of AWS Free Tier credits for new customers, and a free plan chosen at sign-up that lasts 6 months. Neither is a standing Secrets Manager allowance.
Infisical
A free plan for individuals and personal projects; every paid plan additionally carries a free trial with no credit card.
Sources (2) →

Entry paid plan

AWS Secrets Manager
$0.40 per secret per month, plus $0.05 per 10,000 API calls.
Infisical
Pro tier: $20/identity/month billed annually, or $23/identity/month billed monthly.
Sources (2) →

Pricing model

AWS Secrets Manager
Per-secret monthly fee plus metered API calls. Rotating a secret creates a new version but is not separately charged beyond the API calls it makes.
Infisical
Billed per identity per month. An identity is any principal that authenticates to Infisical, human or machine.
Sources (2) →
  • AWS Secrets Manager Pricing ↗

    “Rotating a secret creates a new version of the secret. You are not charged for creating new versions.”

    Read 2026-09-11 · official pricing · Report a correction

  • Infisical Pricing ↗

    “/identity/month An identity is any human or machine that authenticates to Infisical. Everything in Free, plus: Unlimited identities Access Controls Secret Rotation SAML SSO”

    Read 2026-09-14 · official pricing · Report a correction

Regions

AWS Secrets Manager

34 commercial AWS Regions plus 2 AWS GovCloud (US) Regions listed in the Secrets Manager service endpoints table.

Infisical

Infisical Cloud runs in two regions: US (us.infisical.com or app.infisical.com) and EU (eu.infisical.com), each in its own AWS account

Sources (2) →

Uptime SLA

AWS Secrets Manager
99.99% monthly uptime, one figure with no configuration split.
Infisical
The SLA's own wording disagrees with itself: "ninety-nine and nine tenths percent (99.99%)" spells 99.9 and prints 99.99. Either way it applies only to Enterprise tier and above.
Sources (2) →
  • AWS Secrets Manager Service Level Agreement ↗

    “for the billing cycle in which the error occurred in accordance with the schedule below. Monthly Uptime Percentage Service Credit Percentage Less than 99.99% but greater than or equal to 99.0% 10%”

    Read 2026-09-14 · official site · Report a correction

  • Infisical Service Level Agreement ↗

    “infisical will provide actual availability for at least ninety-nine and nine tenths percent (99.99%) of the total time in each calendar month during the subscription term [...] applies only to infisical cloud services at the enterprise tier or above”

    Read 2026-09-14 · official site · Report a correction

Audit logs

AWS Secrets Manager
AWS CloudTrail records every Secrets Manager API call as an event; the last 90 days are viewable in the CloudTrail console, longer retention by creating a trail that delivers to S3.
Infisical
None on Free. 30-day retention on Pro, 90-day on Advanced, custom retention on Enterprise.
Sources (2) →
  • Log AWS Secrets Manager events with AWS CloudTrail - AWS Secrets Manager ↗

    “AWS CloudTrail records all API calls for Secrets Manager as events, including calls from the Secrets Manager console, as well as several other events for rotation and secret version deletion. [...] You can use the CloudTrail console to view the last 90 days of recorded events.”

    Read 2026-09-13 · official docs · Report a correction

  • Infisical Pricing ↗

    “Everything in Free, plus: Unlimited identities Access Controls Secret Rotation SAML SSO 30-day Audit log retention [...] Everything in Pro, plus: Dynamic Secrets Honey Tokens SOC 2 Type II Higher Rate Limits Custom Roles SSO & MFA enforcement 90-day Audit log retention [...] Custom Audit log retention and rate limits”

    Read 2026-09-14 · official pricing · Report a correction

Secret versioning

AWS Secrets Manager
Supported — rotating a secret automatically creates a new version, at no additional per-secret charge.
Infisical
Not included on the free tier. Included from Pro: secret versioning and point-in-time recovery.
Sources (2) →

SOC 2

AWS Secrets Manager
Listed as SOC-compliant on AWS's own compliance scope page.
Infisical
SOC 2 Type 2 report listed in Infisical's Trust Center; access by request.
Sources (2) →

HIPAA

AWS Secrets Manager
Listed as a HIPAA-eligible service on AWS's own reference page.
Infisical
HIPAA listed under Compliance in Infisical's Trust Center, alongside SOC 2 and FIPS 140-3. DPA requires an executed BAA before PHI is submitted.
Sources (2) →

GDPR / data residency

AWS Secrets Manager
Customers choose the geographic Region their data is stored in; AWS states all AWS services can process personal data in compliance with the GDPR. AWS-wide GDPR statement, not a Secrets Manager-specific page.
Infisical
DPA covers EU GDPR, UK GDPR and the Swiss FADP, using the SCCs, UK Addendum or Swiss modifications for transfers out of the EEA, UK or Switzerland.
Sources (2) →
  • GDPR - Amazon Web Services (AWS) ↗

    “AWS customers can use all AWS services to process personal data (as defined in the GDPR) that is uploaded to the AWS services under their AWS accounts (customer data) in compliance with the GDPR [...] Determine where their customer data will be stored, including the type of storage and geographic region of that storage.”

    Read 2026-09-13 · official site · Report a correction

  • Data Processing Agreement | Infisical ↗

    “the EU General Data Protection Regulation (Regulation (EU) 2016/679) ( “EU GDPR” ), the UK General Data Protection Regulation [...] Company will comply using a recognized mechanism, including the SCCs, the UK Addendum, the Swiss modifications to the SCCs, or any other lawful transfer mechanism recognized under Applicable Privacy Law”

    Read 2026-09-13 · official site · Report a correction

PCI DSS

AWS Secrets Manager
Attestation of Compliance for PCI DSS version 3.2 at Service Provider Level 1; can be used for cardholder-data workloads.
Infisical
Payment card information subject to PCI DSS is Restricted Data customers may not submit without express prior written agreement.
Sources (2) →

Encryption at rest

AWS Secrets Manager
Envelope encryption: each secret value is encrypted with a unique 256-bit AES data key, itself encrypted under an AWS KMS key.
Infisical
Secrets and sensitive data encrypted with AES-256-GCM before being persisted to the storage backend.
Sources (2) →

Customer-managed keys

AWS Secrets Manager
Any symmetric-encryption customer managed KMS key in the same account and Region can encrypt a secret, instead of the aws/secretsmanager AWS managed key. Asymmetric KMS keys are not supported; keys are chosen per secret.
Infisical
A project can be encrypted with an external KMS — AWS KMS or GCP KMS — instead of Infisical's internal KMS.
Sources (2) →

Role-based access control

AWS Secrets Manager
IAM identity-based and resource-based policies define who can take which actions on which secrets; attribute-based access control (ABAC) is also supported.
Infisical
Role-based, attribute-based, and one-off additional-privilege resource constraints.
Sources (2) →
  • Authentication and access control for AWS Secrets Manager - AWS Secrets Manager ↗

    “Secrets Manager uses AWS Identity and Access Management (IAM) to secure access to secrets. IAM provides authentication and access control. [...] Secrets Manager uses policies to define who has access to which resources, and which actions the identity can take on those resources. [...] Control access to secrets using attribute-based access control (ABAC)”

    Read 2026-09-13 · official docs · Report a correction

  • Security — Infisical Docs ↗

    “The access control policies are configured by operators of Infisical ahead of time and may involve role-based, attribute-based, and one-off "additional privilege" resource constraints.”

    Read 2026-09-14 · official docs · Report a correction

Private networking / VPC

AWS Secrets Manager
Interface VPC endpoints powered by AWS PrivateLink reach the Secrets Manager API with no internet gateway; traffic does not leave the AWS network.
Infisical
Gateways run inside your own network so Infisical can reach private resources; a paid feature under the Enterprise Tier for Infisical Cloud.
Sources (2) →
  • Using an AWS Secrets Manager VPC endpoint - AWS Secrets Manager ↗

    “You can establish a private connection between your VPC and Secrets Manager by creating an interface VPC endpoint [...] Instances in your VPC don't need public IP addresses to communicate with Secrets Manager APIs. Traffic between your VPC and Secrets Manager does not leave the AWS network.”

    Read 2026-09-13 · official docs · Report a correction

  • Networking - Infisical ↗

    “Some of the systems Infisical connects to aren't reachable from the internet: a database in a private subnet, an on-premises appliance, a server behind a corporate firewall. [...] Gateway is a paid feature available under the Enterprise Tier for Infisical Cloud users.”

    Read 2026-09-13 · official docs · Report a correction

When these numbers change, hear about it. Sources are re-checked monthly; a repricing goes out as a short note.

Confirm by email; unsubscribe from any issue. Your address goes to Kit and nowhere else — what we do with it.

03.

Documented by only one.

These criteria are published by one provider and not the other. An absence here means we have not found a source, not that the feature is missing — except where we say we read the other provider's own page on a given date and it does not state it. Those rows lean, and the provider can correct them with a link.

When the free offer endsAWS Secrets Manager: 6 months after account creation; Free Tier credits expire 12 months after that date.
Dynamic (short-lived) secretsInfisical: Not included on Free or Pro. Included from Advanced: dynamic secrets.
Support on entry paid planInfisical: Community support Help from the Infisical community and team through public channels like Slack and GitHub.
ISO 27001AWS Secrets Manager: Certified for ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018 and ISO 9001; Secrets Manager is named in AWS's per-service compliance list.
Dedicated infrastructureInfisical: Infisical Cloud is multi-tenant by default; dedicated cloud instances are available for enterprises with stricter isolation or regulatory needs.
04.

Questions this comparison answers.

Entry paid plan: AWS Secrets Manager or Infisical?

AWS Secrets Manager: $0.40 per secret per month, plus $0.05 per 10,000 API calls.

Infisical: Pro tier: $20/identity/month billed annually, or $23/identity/month billed monthly.

Free tier: AWS Secrets Manager or Infisical?

AWS Secrets Manager: No

Infisical: Yes

Should I choose AWS Secrets Manager or Infisical?

Pick AWS Secrets Manager if Teams already deep in AWS IAM, Lambda and RDS — the integration is native rather than bolted on, and the per-secret price is simple to reason about.

Pick Infisical if Teams that want per-identity pricing that treats a machine credential the same as a human one, or that value the option to self-host the same open-source engine the cloud product runs.

Provider pages

AWS Secrets ManagerAWS-native secrets store billed per secret per month plus per API call, integrated with IAM, Lambda and RDS.InfisicalOpen-source secrets manager billed per identity (human or machine), with versioning and dynamic secrets on paid tiers.

Related comparisons

AWS Secrets Manager vs DopplerDoppler vs Infisical

Comments

Every page here is sourced and dated.