When it comes to secrets management, Hashicorp Vault is one of the first things that come to mind. This secret and sensitive data protection system is a popular choice for many organizations with its ability to connect to various DevOps and Orchestration platforms and encryption-as-a-service features.
One of the main reasons you might want to consider an alternative would be the amount of time and effort you’ll need to invest with self-deploying Hashicorp Vault production-grade clusters: It is known to be very complex to set up and entails manual vault token management in most cases. For instance, have a look at the 273-page “Running HashiCorp Vault in Production” book on Amazon to have a clue about just how complicated this is.
Furthermore, according to market estimations, HashiCorp Vault Enterprise version cost is around tens of thousands of dollars for a single cluster. Multiply that for a multi-region environment with non-production clusters for DR and staging, and you’re easily going for hundreds of thousands of dollars per year. Regardless, the fact that HashiCorp does not indicate the prices of its solutions will imply that the price can potentially be a concern for many potential customers.
So, if you are looking for HashiCorp Vault alternatives, consider the following options:
Akeyless Vault
The first Hashicorp Vault alternative would be Akeyless Vault, which surprisingly provides a larger feature set compared to Hashicorp. More importantly, Akeyless Vault uniquely addresses the first of the major drawbacks of HashiCorp Vault – deployment complexity. Akeyless provides a unified SaaS platform to manage secrets across workloads, applications, and servers seamlessly. Its software-as-a-service offering does not require any installation and maintenance. Onboarding is near-instant with no configurations to undertake. Considering the complex project of having a Hashicorp Vault in production (as mentioned above), Akeyless provides a very intriguing alternative.
SDK, CLI, dashboards, and analytics are provided right when you sign up so organizations can get started immediately, together with numerous plugins to connect to any DevOps platform easily. You may also use the plugins that were developed by the Hashicorp Vault OpenSource community to work with Akeyless Vault, as they have developed API compatibility with Vault open source version.
Moreover, Akeyless features a patent-pending Distributed Fragments Cryptography (DFC) technology, which acts as a Virtual HSM (a software-based NIST FIPS 140-2 Certified Security) that guarantees the customer’s exclusive ownership of her secrets and keys. Meaning, Akeyless is blind to its customer’s secrets. Their DFC technology creates fragments of encryption key rather than encryption key as a whole, and stores the fragments in separate cloud servers. One of the key fragments is optionally kept in the customer’s environment. By that, even when a cloud service provider is legally compelled to turn over your data to authorities – Akeyless won’t even have the ability to provide your decrypted secrets, simply because they don’t have all the key fragments.
Cost: Business package starting at $1400 per month for 100 clients and 5,000 secrets, plus offers a thirty-day free trial. It also has a free package (community) that covers 50 secrets for 3 clients (with an option to expand as you need). This price can actually make Vault OSS customers consider using Akeyless’ Auto-Migration tool, having such an alternative that provides support and zero maintenance, not to mention Hashicorp Vault Enterprise customers who may rethink their astronomus current TCO.
KeePass
Free and open source–these features easily make KeePass one of the best options for secrets management for organizations of all sizes. It is mainly intended for managing passwords, credentials, and other similar data, though. KeePass is not optimized for the management of more sophisticated secrets such as private keys, certificates, authentication tokens, and SSH keys, however.
This minimalistic secrets manager provides robust features and a great deal of customizability. Its encryption uses the Twofish algorithm and Advanced Encryption Standard (AES), a security mechanism approved by the United States National Security Agency for top secret information. KeePass allows users to maintain one master password for the decryption of the entire database, but it also provides the option to use key files. The latter is deemed to be more secure as it entails more steps to enable data access. However, both the master password and key files can be used at the same time.
Slow setup is not going to be one of the drawbacks of this tool as it has a portable version. Users can carry KeePass in a USB flash drive to be run on Windows systems without the need for installation. Additionally, it is designed to import secrets from and export them to a wide range of file formats.
Bottom line – great to start with, yet not an enterprise-grade solution and lacks the plugins you’d need when you grow (to Kubernetes, Jenkins, etc).
Cyberark Privileged Access Security Solution (aka Conjur)
CyberArk, the leader of the privileged access management market, has lately announced their secrets management solution, CyberArk Application Access Manager provides an enterprise-class and policy-based approach in handling and protecting secrets. It is designed to manage and track all forms of privileged accounts.
As an enterprise privileged access manager, Cyberark is notably flexible and modifiable. Access can be granted at a very granular level. It also comes with a redundancy feature that makes it easy to add another server behind the set load balancer. It emphasizes security and privacy to give users peace of mind whenever they use or transmit secrets. It also continuously discovers privileged accounts and credentials across an enterprise to make sure they are tracked and managed securely.
If there is any drawback with Cyberark, though, it is the time it takes to take it to production and speed or lack thereof. There are times when it feels sluggish. Sometimes it times out even after verifying the credentials. Also, group privilege management leaves some room for improvement.
AWS Secrets Manager
The secrets management solution from Amazon, AWS Secrets Manager is designed to streamline the management of secrets used in the various applications, services, and IT resources of an enterprise. It is a good HashiCorp Vault alternative only as a static secrets manager and allows the easy storage and retrieval of API secrets and other secrets throughout their lifecycle.
As an Amazon Web Services product, AWS Secrets Manager is often characterized as the cloud-optimized counterpart of HashiCorp Vault. It offers a familiar interface for those who are already using Amazon services. It provides secrets management with fine-grained policies and enables secure centralized secrets auditing.
Additionally, this secrets management solution offers a pay-as-you-go pricing approach, which can be highly advantageous for growing companies. It takes away any upfront expense and ongoing maintenance costs associated with other secrets management solutions.
That said, Secret Manager by AWS would not provide you any connectivity with third-party platforms (CI/CD/CM), their SDK isn’t considered to be straight forward. The worst part–it’s not really usable as a unified solution when you have multiple environments to include some on-prem – Hybrid Cloud, not to mention when you have workloads on two cloud providers. Large or regulated enterprises would also find themselves with the problem of the Cloud Act‘ where CSPs are obligated to provide Keys and Secrets of their customers to the federal authority when being asked. Having all eggs in AWS would make you exposed to that risk.
Thycotic Secret Server
Thycotic Secret Server is a comprehensive enterprise-level privileged access management and auditing solution. Offered with cloud and on-premises versions, it provides a rich selection of features to handle privileged account passwords and a host of other secrets.
One of Thycotic’s best features is its Secret Server SDK, which is designed to secure privileges used in DevOps environments. It offers stringent security best practices without hindering the speed and efficiency expected from DevOps processes. It is built to work efficiently when using passwords and privileges for app, service, root, and administrator accounts.
Thycotic Secret Server features a discovery function, which identifies all accounts that use secrets to provide visibility for all privileged access. It also has an access delegation feature that lets users set up role-based access control and a defined workflow for access requests.
Conclusion
There are alternatives to HashiCorp Vault. Some are better than others. Make sure to do a features comparison and consider the expected effort, license fees, compute resources vs. budget limitation. Needless to say, remember that open-source has its own costs and that SaaS models would probably provide the maximum flexibility, efficiency, and cost effectiveness.
