Keys, secrets & certificates
AWS Secrets Manager vs Azure Key Vault
AWS Secrets Manager maps to Azure Key Vault secrets.
Side-by-side comparison
| Aspect | Amazon Web Services | Microsoft Azure |
|---|---|---|
| Service | AWS Secrets Manager | Azure Key Vault |
| Lifecycle | Generally available | Generally available |
| What it is | Stores, retrieves, and automatically rotates database credentials, API keys, OAuth tokens, and other secrets on a schedule. | Stores keys, secrets, and certificates. Standard uses software-protected keys, and Premium adds HSM-protected keys (FIPS 140-3 Level 3 HSMs), with RBAC, soft delete, and purge protection. |
| Pricing model | Per secret per month plus per 10,000 API calls. | Per 10,000 secret operations, with no per-secret monthly fee. |
| Docs | AWS Secrets Manager docs | Azure Key Vault docs |
| Pricing page | AWS Secrets Manager pricing | Azure Key Vault pricing |
| Exams | SAA-C03 DVA-C02 Retiring SCS-C03 | AZ-104 AI-200 SC-500 |
Key differences
- Rotation. Secrets Manager has built-in rotation (managed for RDS and other services, or Lambda-based). Key Vault raises near-expiry events through Event Grid, and you rotate with Azure Functions or automation. Better still, use managed identities so there's no secret to rotate.
- Cheaper alternative on AWS. Systems Manager Parameter Store also holds secrets (SecureString) without built-in rotation.
Pricing summary
Pricing models only. No prices are quoted because they change by region and over time.
- AWS
- Per secret per month plus per 10,000 API calls. AWS Secrets Manager pricing →
- Azure
- Per 10,000 secret operations, with no per-secret monthly fee. Azure Key Vault pricing →
Certification exam mapping
| Exam | Provider | Level | Status |
|---|---|---|---|
| AWS Certified Solutions Architect – Associate SAA-C03 | AWS | Associate | current Italian version retires after Dec 31, 2026. |
| AWS Certified Developer – Associate DVA-C02 | AWS | Associate | retiring Being updated to DVA-C03. Registration for DVA-C03 opens Oct 27, 2026. Last day to take DVA-C02 is Nov 30, 2026. |
| AWS Certified Security – Specialty SCS-C03 | AWS | Specialty | current The current code (SCS-C03) is taken from the exam-prep link on the official certification page. Simplified Chinese, Spanish (Latin America), and Portuguese (Brazil) versions retire after Dec 31, 2026. |
| Microsoft Certified – Azure Administrator Associate AZ-104 | Azure | Associate | current |
| Microsoft Certified – Azure AI Cloud Developer Associate AI-200 | Azure | Associate | current Back-end services, containers, and architecture for AI solutions on Azure. |
| Microsoft Certified – Cloud and AI Security Engineer Associate SC-500 | Azure | Associate | current New certification. A practice assessment isn't available yet, which the page says usually means the exam recently left (or is in) beta. |
Relevance is based on each exam's published scope, not a line-by-line objective match. Check the official study guide.
FAQ
What is the Azure equivalent of AWS Secrets Manager?
AWS Secrets Manager maps to Azure Key Vault secrets.
How does pricing compare between AWS Secrets Manager and Azure Key Vault?
AWS: Per secret per month plus per 10,000 API calls. Azure: Per 10,000 secret operations, with no per-secret monthly fee. Check the official pricing pages for current rates.
Which certification exams cover this topic?
AWS Certified Solutions Architect – Associate (SAA-C03); AWS Certified Developer – Associate (DVA-C02) [retiring]; AWS Certified Security – Specialty (SCS-C03); Microsoft Certified – Azure Administrator Associate (AZ-104); Microsoft Certified – Azure AI Cloud Developer Associate (AI-200); Microsoft Certified – Cloud and AI Security Engineer Associate (SC-500).