Pulumi ESC vs HashiCorp Vault
Pulumi ESC
Pulumi ESC (Environments, Secrets, Configuration) is a secrets and configuration platform that lets you compose environments from multiple secret sources (AWS, Vault, Doppler, 1Password) and expose them as environment variables, files, or direct SDK calls. ESC is tightly integrated with Pulumi's infrastructure-as-code platform but works as a standalone tool too.
Pros
- Sits cleanly on top of existing secrets stores. No migration needed
- Composition model makes multi-cloud environments simple
- Strong fit if you already use Pulumi for IaC
- OIDC-based auth eliminates static Pulumi tokens
Things to check
- Newer product; smaller community than Doppler/Infisical
- Best value only realized if you adopt Pulumi IaC too
- Per-user pricing at the Team tier is steep
- No self-hosted option
Pricing: Free tier (Pulumi Cloud Individual, $0); ESC metered per secret from $0.50/secret/mo (Team) and $0.75/secret/mo (Enterprise), on top of base tiers Team $40/mo and Enterprise $400/mo
HashiCorp Vault
HashiCorp Vault is a widely adopted open-source secrets management tool. It provides a unified interface for managing secrets, encrypting data in transit, and controlling access to sensitive information across distributed infrastructure. Vault supports dynamic secrets, leasing, and revocation.
Pros
- Massive community and ecosystem
- Highly extensible with plugins
- Strong enterprise features
- Multi-cloud and hybrid support
- Free open-source tier
Things to check
- Steep learning curve
- Complex to operate at scale
- Requires dedicated infrastructure
- Enterprise features require paid license
Pricing: Free self-managed Community edition (Business Source License, not true OSS); HCP Vault Dedicated managed cloud from $0.03/hr (about $22/mo) Development tier (HCP rates as of 2022; tiers have since been renamed, verify current pricing), production tiers from about $1.58/cluster-hr plus per-client fees; Vault Enterprise self-managed license is quote-only (contact sales).