---
title: "Cloud Secret Manager: What It Is and How to Choose One"
url: https://uselinkpilot.com/blog/cloud-secret-manager
description: "What a cloud secret manager stores and protects, how to choose between AWS, Google, Azure and Vault, how to roll one out, and the human handoff gap it leaves."
lang: en
---

Security (https://uselinkpilot.com/blog/category/security)

# Cloud secret manager: what it is, how to choose one, and what it does not cover

What a cloud secret manager stores and protects, how to choose between AWS, Google, Azure and Vault, how to roll one out, and the human handoff gap it leaves.

LinkPilot Team (https://uselinkpilot.com/author/linkpilot-team) · The people who build and run LinkPilot at TetraCore, LLC October 26, 2026 · About LinkPilot (https://uselinkpilot.com/about)

Every team eventually reaches the point where credentials are in too many places: a `.env` on each laptop, a pinned message in Slack, a spreadsheet called "logins", a CI variable someone set two years ago. A cloud secret manager exists to collapse all of that into one place that is encrypted, access-controlled and audited.

This guide explains what a cloud secret manager does, how to choose between the main options, how to roll one out without a long migration, and the one job it does not do, which is getting a secret to a human who is not inside your cloud account.

## What a cloud secret manager does

A secret manager stores sensitive values and hands them to authorised identities on request. The core features are the same across providers:

- **Encrypted storage** at rest, with keys held in the provider's key management service, and TLS in transit.
- **Identity-based access**: each secret has a policy saying which users, roles or workloads may read, write or rotate it. An application authenticates with its own identity, not with a master password.
- **Audit logging** of every read, write and rotation, with who, what and when.
- **Versioning and rotation**: a new value can be staged, applications switched over, and the old version retired. Many managers rotate database credentials automatically.
- **Runtime retrieval**: the application fetches the secret when it starts or when it needs it, so the value is never written into code, images or config files.

A secret is anything that grants access. Configuration that merely describes behaviour, such as a port number or a feature flag, belongs in ordinary config. Mixing the two makes the secret store noisy and the config store dangerous.

## How to choose one

The decision usually comes down to where your workloads run and how many clouds you are in.

| Option | Best fit | Watch for | | --- | --- | --- | | AWS Secrets Manager / Parameter Store | Workloads already on AWS, IAM identities everywhere | Per-secret pricing on Secrets Manager; Parameter Store is cheaper for plain values | | Google Secret Manager | GCP projects, Cloud Run and GKE workloads | Regional replication choices | | Azure Key Vault | Azure workloads, certificate lifecycle needs | Separate vaults per environment to keep policies simple | | HashiCorp Vault | Multi-cloud or on-prem, dynamic short-lived credentials | Operating it yourself unless you use the hosted version | | Doppler, Infisical, 1Password Secrets Automation | Small teams wanting developer-friendly sync to many platforms | Another vendor in the trust chain |

Four questions settle most choices. Does it integrate with your deployment tooling and runtime without custom glue? Can workloads authenticate to it with the identity they already have? Does it rotate the credential types you actually hold? And do its audit logs land where your security team already looks? Pricing, regions and compliance attestations come after those four.

## Rolling one out without a six-month project

1. **Inventory and assign owners.** List every secret, where it lives, what uses it, and who is responsible. The owner decides the rotation policy and the access list.
2. **Set up identities first.** Create the roles or service accounts for each workload and environment before you move a single value. Access policies that say "this service, this environment, read only" are the whole point.
3. **Migrate in order of risk.** Production database passwords and payment keys first, then third-party API (https://uselinkpilot.com/glossary#api) keys, then everything else. Remove each value from code, CI variables and config files as it moves, and rotate it on the way in, because the old value has already been copied around.
4. **Change how applications read secrets.** Replace hard-coded values and environment files with a call to the manager's SDK (https://uselinkpilot.com/glossary#sdk) at startup, or inject them with the platform's native integration.
5. **Turn on rotation** for anything the manager can rotate itself, and write a rotation function or runbook for the rest.
6. **Alert on the unusual.** A secret read from a new identity, a spike in reads, or a read from a region you do not deploy to is worth a page.

Common mistakes are predictable: leaving the old copies in place after migration, giving a workload read access to the whole store instead of its own secrets, and logging the retrieved value in application logs.

## The gap a secret manager does not fill

A secret manager is built for machines and for people inside your identity system. It is not built for the moment a credential has to reach someone outside it: a contractor who needs a temporary database password, a client receiving their first admin login, a vendor's engineer who needs a token for an afternoon, a new hire on day one before their SSO (https://uselinkpilot.com/glossary#single-sign-on) account exists.

Those handoffs happen anyway, and without a sanctioned route they happen in email and chat, which is where secret managers were supposed to get credentials out of. The sanctioned route is a one-time secret link (https://uselinkpilot.com/tools/free-secret-link-generator). The value is encrypted in your browser before it is stored, the message carries only a link, the stored copy is destroyed the first time the link is opened, and the link expires on a timer if nobody opens it.

The pattern that works: the secret manager is the system of record, and the one-time link (https://uselinkpilot.com/glossary#one-time-link) is the delivery mechanism when a human outside the system needs a value once. Generate the credential, store it in the manager, send it to the person through a one-time link, and rotate it when their access ends. Secret links vs password managers (https://uselinkpilot.com/blog/secret-links-vs-password-managers) applies the same reasoning to the team password manager, and the credentials between teams (https://uselinkpilot.com/blog/how-to-create-a-secure-way-to-hand-off-credentials-between-teams) guide covers the routine.

## A short checklist

- Every secret has an owner, an access policy and a rotation rule.
- Workloads authenticate with their own identity, never a shared key.
- No secret exists in code, images, CI variables or chat after migration.
- Reads are logged somewhere a person actually looks.
- Humans outside the identity system receive secrets through a one-time link, not a message.

Do those five things and the secret manager stops being a product you bought and becomes the reason credentials stopped leaking.

## Related reading

- How to share API keys securely: https://uselinkpilot.com/blog/how-to-share-api-keys-securely
- Secure link sharing for developers: https://uselinkpilot.com/blog/secure-link-sharing-for-developers
- How to create a secure way to hand off credentials between teams: https://uselinkpilot.com/blog/how-to-create-a-secure-way-to-hand-off-credentials-between-teams
- Secret links vs password managers: https://uselinkpilot.com/blog/secret-links-vs-password-managers

## Tools for this article

One-Time Secret Link Generator

Share a password or note through a link that opens once.
https://uselinkpilot.com/tools/free-secret-link-generator

Self-Destructing Message

Send a note that disappears after one read.
https://uselinkpilot.com/tools/burn-after-read-secret

Expiring Link Generator

Create links that stop working at a set time.
https://uselinkpilot.com/tools/temporary-link

## Frequently asked questions

### What is a cloud secret manager?

### What should you store in a secret manager?

### How do applications read secrets from it?

### How often should secrets be rotated?

### Do secret managers encrypt stored values?

### What is the difference between secret storage and secret sharing?

## LinkPilot sends a secret link that is gone after it is opened.

Encrypted in your browser, revealed once, then destroyed. No account needed.

Create a secret link (https://uselinkpilot.com/tools/free-secret-link-generator)

## Read next

Security

### AWS Access Key and Secret Key: How to Create, Use, Rotate and Share Them Safely

What an AWS access key ID and secret access key are, why the secret shows once, how to rotate them, what to do after a leak, and how to share one safely.
https://uselinkpilot.com/blog/aws-access-key-and-secret-key

Security

### How to Share SSH Credentials With a Link That Expires (Securely)

Prefer the recipient's public key. When a private key or password must move, send it as a one-time link that expires and send the host and username separately.
https://uselinkpilot.com/blog/how-to-share-ssh-credentials-with-a-link-that-expires-securely

Security

### How to Share Credentials Securely Without Email

Four ways to share a password without email, when each one fits, and a step-by-step for a temporary link for sharing login details that burns after one open.
https://uselinkpilot.com/blog/how-to-share-credentials-securely-without-email

## Structured data

```json
[
  {
    "@context": "https://schema.org",
    "@type": "SoftwareApplication",
    "@id": "https://uselinkpilot.com/#software",
    "name": "LinkPilot",
    "applicationCategory": "BusinessApplication",
    "operatingSystem": "Web",
    "description": "LinkPilot is a secure link management platform for creating branded short links, tracking engagement, and sharing secrets with expiring, protected, self-destructing links.",
    "url": "https://uselinkpilot.com",
    "offers": [
      {
        "@type": "Offer",
        "name": "Free",
        "price": "0",
        "priceCurrency": "USD",
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Pro",
        "price": "29",
        "priceCurrency": "USD",
        "priceSpecification": {
          "@type": "UnitPriceSpecification",
          "price": "29",
          "priceCurrency": "USD",
          "billingDuration": "P1M"
        },
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Agency",
        "price": "299",
        "priceCurrency": "USD",
        "priceSpecification": {
          "@type": "UnitPriceSpecification",
          "price": "299",
          "priceCurrency": "USD",
          "billingDuration": "P1M"
        },
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Agency Plus",
        "price": "799",
        "priceCurrency": "USD",
        "priceSpecification": {
          "@type": "UnitPriceSpecification",
          "price": "799",
          "priceCurrency": "USD",
          "billingDuration": "P1M"
        },
        "url": "https://uselinkpilot.com/pricing"
      },
      {
        "@type": "Offer",
        "name": "Enterprise",
        "priceSpecification": {
          "@type": "PriceSpecification",
          "priceCurrency": "USD"
        },
        "url": "https://uselinkpilot.com/pricing"
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "Organization",
    "@id": "https://uselinkpilot.com/#organization",
    "name": "LinkPilot",
    "alternateName": "LinkPilot by TetraCore",
    "url": "https://uselinkpilot.com",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "support@uselinkpilot.com",
      "url": "https://uselinkpilot.com/support"
    },
    "parentOrganization": {
      "@type": "Organization",
      "@id": "https://tetracorehq.com/#organization",
      "name": "TetraCore",
      "url": "https://tetracorehq.com/"
    },
    "logo": {
      "@type": "ImageObject",
      "url": "https://uselinkpilot.com/logo-512.png",
      "width": 512,
      "height": 512
    },
    "description": "LinkPilot is a secure link management platform for creating branded short links, tracking engagement, and sharing secrets with expiring, protected, self-destructing links.",
    "sameAs": [
      "https://x.com/uselinkpilot",
      "https://www.linkedin.com/company/uselinkpilot",
      "https://facebook.com/uselinkpilot",
      "https://github.com/TetraCoreHQ/linkpilot-cli",
      "https://github.com/TetraCoreHQ/linkpilot-mcp",
      "https://www.npmjs.com/package/linkpilot",
      "https://www.npmjs.com/package/@uselinkpilot/sdk",
      "https://www.npmjs.com/package/@uselinkpilot/mcp",
      "https://chromewebstore.google.com/detail/linkpilot-short-links-and/mnmppadihpcncicldpkmgknhnjkondad"
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "WebSite",
    "name": "LinkPilot",
    "url": "https://uselinkpilot.com",
    "potentialAction": {
      "@type": "SearchAction",
      "target": "https://uselinkpilot.com/blog?q={search_term_string}",
      "query-input": "required name=search_term_string"
    }
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "position": 1,
        "name": "Home",
        "item": "https://uselinkpilot.com/"
      },
      {
        "@type": "ListItem",
        "position": 2,
        "name": "Blog",
        "item": "https://uselinkpilot.com/blog"
      },
      {
        "@type": "ListItem",
        "position": 3,
        "name": "Cloud Secret Manager: What It Is, How to Choose One, and What It Doesn't Cover",
        "item": "https://uselinkpilot.com/blog/cloud-secret-manager"
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "BlogPosting",
    "@id": "https://uselinkpilot.com/blog/cloud-secret-manager#article",
    "headline": "Cloud Secret Manager: What It Is, How to Choose One, and What It Doesn't Cover",
    "description": "What a cloud secret manager stores and protects, how to choose between AWS, Google, Azure and Vault, how to roll one out, and the human handoff gap it leaves.",
    "datePublished": "2026-10-26",
    "dateModified": "2026-10-26",
    "image": "https://uselinkpilot.com/logo-512.png",
    "author": {
      "@type": "Organization",
      "@id": "https://uselinkpilot.com/author/linkpilot-team#organization",
      "name": "LinkPilot Team",
      "url": "https://uselinkpilot.com/author/linkpilot-team"
    },
    "publisher": {
      "@type": "Organization",
      "name": "LinkPilot",
      "url": "https://uselinkpilot.com",
      "logo": {
        "@type": "ImageObject",
        "url": "https://uselinkpilot.com/logo-512.png",
        "width": 512,
        "height": 512
      }
    },
    "mainEntityOfPage": {
      "@type": "WebPage",
      "@id": "https://uselinkpilot.com/blog/cloud-secret-manager"
    }
  },
  {
    "@context": "https://schema.org",
    "@type": "FAQPage",
    "mainEntity": [
      {
        "@type": "Question",
        "name": "What is a cloud secret manager?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "A managed service that stores credentials such as API keys, database passwords and certificates encrypted, controls which identities can read each one, logs every access, and can rotate values on a schedule. Applications fetch secrets from it at runtime instead of holding them in code or config."
        }
      },
      {
        "@type": "Question",
        "name": "What should you store in a secret manager?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Anything that grants access: passwords, API keys, tokens, private keys, certificates, connection strings with embedded credentials. Plain configuration such as log levels and feature flags belongs in config, not the secret store."
        }
      },
      {
        "@type": "Question",
        "name": "How do applications read secrets from it?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Through the provider's SDK or CLI, authenticated by the workload's own identity, for example an IAM role or a Kubernetes service account. The application never holds a long-lived credential to reach the secret store."
        }
      },
      {
        "@type": "Question",
        "name": "How often should secrets be rotated?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "On a schedule for long-lived values that support it, and immediately on events: a departure, a vendor change, any suspected exposure. Most managers can rotate database passwords automatically; API keys from third parties usually need a rotation function or a manual step."
        }
      },
      {
        "@type": "Question",
        "name": "Do secret managers encrypt stored values?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Yes, at rest with a key held in the provider's key management service, and in transit over TLS. Access is still governed by the permissions you set, so encryption does not protect against an over-broad policy."
        }
      },
      {
        "@type": "Question",
        "name": "What is the difference between secret storage and secret sharing?",
        "acceptedAnswer": {
          "@type": "Answer",
          "text": "Storage is where a secret lives and how machines and authorised people retrieve it over time. Sharing is the moment a value has to reach a person who is not in that system: a contractor, a client, a new hire. A secret manager does the first. A one-time secret link does the second without leaving a copy in a message."
        }
      }
    ]
  }
]
```