IaC Bazaar
Browse modules
Menu

Secrets & Key Management across clouds

Secret stores and KMS (Key Vault, Secrets Manager, KMS, Vault) with verified, least-privilege modules.

23 verified modules, 5 of them live-tested apply→verify→destroy; the rest are static-validated, live-test pending.

Compare by provider

ProviderModuleVerification
Alibaba CloudA KMS Key that Rotates and Cannot Be Scheduled for Deletionstatic-validated
Alibaba CloudA KMS Secret Encrypted with Your Key, with a Recovery Window Before It Is Gonestatic-validated
AWSKMS Key with Policy Patterns✓ live-tested
AWSSecrets Manager Secret✓ live-tested
AzureAzure Key Vault✓ live-tested
ExoscaleA KMS Key Placed on Purpose with What the Service Lacks Written Downstatic-validated
Google CloudCloud KMS Keyring & Keys✓ live-tested
Google CloudSecret Manager Secrets✓ live-tested
Huawei CloudA CSMS Secret Encrypted with Your KMS Key, with an Expirystatic-validated
Huawei CloudA KMS Key that Rotates with the Longest Deletion Windowstatic-validated
IBM CloudA Root Key that Rotates and Takes Two People to Deletestatic-validated
IBM CloudA Secret Group and an Arbitrary Secret in an Instance You Already Pay Forstatic-validated
Multi-cloud & platform-agnosticA KV v2 Engine that Keeps Versions and Refuses Blind Overwritesstatic-validated
Multi-cloud & platform-agnosticAppRole Roles that Bind to Somewhere Specific and Issue Secret IDs that Expirestatic-validated
Multi-cloud & platform-agnosticDynamic PostgreSQL Credentials with the Root Password Rotated Awaystatic-validated
Multi-cloud & platform-agnosticOIDC Auth Whose Roles Admit the Claims You Namestatic-validated
Multi-cloud & platform-agnosticTransit Keys that Rotate and Cannot Be Deleted or Exportedstatic-validated
Multi-cloud & platform-agnosticVault Policies & Authstatic-validated
Oracle CloudVault, Keys & Secretsstatic-validated
OVHcloudSecrets that Expire on a Date You Setstatic-validated
ScalewaySecrets that Cannot Be Deleted in One Call and Versions that Expirestatic-validated
Tencent CloudA KMS Key that Rotates with the Longest Deletion Windowstatic-validated
Tencent CloudA Secret and Its Version, Encrypted with Your KMS Key, with a Recovery Windowstatic-validated

How to choose

Use a KMS for encryption keys and envelope encryption; use a secrets manager for credentials with rotation. Vault fits multi-cloud or dynamic-secret needs.

When not to use

Never substitute environment variables or config files for these - but also do not store large blobs in a secrets store; it is not object storage.

Other solutions

Managed Relational Database25DNS & Traffic Management23Messaging & Pub/Sub22Load Balancer21Virtual Machines21Virtual Private Cloud (VPC)19Cloud Firewall17Managed Kubernetes16Object Storage16Block Storage16Golden Images14Container Registry12Identity & Access12In-Memory Cache12Shared File Storage11Managed NoSQL Database11Serverless Functions10CDN & Edge Delivery10WAF & Edge Security10NAT Gateway10Serverless Containers9Monitoring & Observability9Managed Search9Static Site Hosting9Managed TLS Certificates9Network Peering9Audit Log Retention9Cloud Data Warehouse9API Gateway8Site-to-Site VPN8Dedicated Interconnect8Backup Service8Managed CI/CD8Transit Hub8Managed Spark8Network Flow Logs8Security Posture & Findings7Database Migration & CDC7Managed Network Firewall7Private Instance Access7Organisation Guardrails7Private Service Endpoints7Private Certificate Authority6Managed ML Platform6Transactional Email6Managed App Platform6Customer Identity6Uptime Checks6Landing Zone6Budgets & Cost Alerts5Patch Management5Managed ETL Pipelines4Workflow Orchestration4HPC Parallel File Systems4Managed BI4Data Transfer Service3Managed Active Directory3Zero Trust Application Access3Sensitive Data Discovery3