Originally published on DevToolHub .

Pick the secrets manager that lives in the cloud your workloads already run in. The AWS Secrets Manager vs Azure Key Vault vs GCP Secret Manager choice then comes down to three things the product pages bury: how each one bills, which one rotates secrets for you, and how hard each one makes an accidental delete.

I pulled every number below from the vendors' own pricing, quota and rotation pages on 2026-10-28, and I ran the cost scenarios myself. But I did not create secrets in any of the three clouds for this post. The AWS and Azure flags match the installed CLIs (aws-cli 2.38.6, azure-cli 2.90.0).…