AWS Secrets Manager vs Azure Key Vault

AWS Secrets Manager

IAM roles support access without long-lived credentials on AWS compute services. Each API call is billed, making caching relevant to frequent reads.

Azure Key Vault

Access runs on Microsoft Entra ID tokens and Azure roles that can be scoped to one secret, with soft delete, a 99.99 per cent SLA and a public OpenAPI contract. Secret rotation needs an Event Grid trigger and a function the owner writes, audit logging is off until enabled, and an Azure subscription needs a person and a payment card.

AWS Secrets Manager

1. Give the agent's task or instance role secretsmanager:GetSecretValue on the specific secret ARN, not a wildcard
2. Cache the value for the run, or read through the Workload Credentials Provider on localhost; each GetSecretValue is billed and logged
3. In Claude Code or Codex, install the aws-core plugin from the Agent Toolkit for AWS and pass secrets as {{resolve:secretsmanager:...}} references through asm-exec so values stay out of context
4. Pass a ClientRequestToken on PutSecretValue so a retry can't create a second version, and don't write more than once every 10 minutes
5. Read VersionStage AWSPREVIOUS if a rotation lands mid-run and the new credential isn't live yet

Azure Key Vault

1. Request a token for the resource https://vault.azure.net and send it as a Bearer header. Every call must carry api-version, such as 2025-07-01, because there is no default
2. Ask for the Key Vault Secrets User role on the vault or the single secret. Key Vault Reader returns metadata only, not values
3. Cache secret values in memory. A vault allows 4,000 reads and 300 secret creations per 10 seconds, and a subscription five times that
4. On 429 wait 1, 2, 4, 8 then 16 seconds. Throttled requests do not count against the limit
5. Don't retry Set Secret blindly. Each successful call creates a new version of the secret