Get an audit

Head to head · Secrets store · October 2026 research run

AWS Secrets Manager vs Pulumi ESC

AWS Secrets Manager scores 77.7 (BB) on agent readiness against Pulumi ESC's 71.1 (BB), and leads in 5 of 7 scored categories. Pulumi ESC leads on payments & pricing and maintenance & community. Both do secrets store.

AWS Secrets ManagerAmazon Web Services · HTTP API BB77.7/100#18 of 629 Pulumi ESCPulumi Corporation · HTTP API BB71.1/100#114 of 629

Which one, for what

AWS Secrets Manager BB

Good for Agents running on AWS compute that should read credentials through a role with no key at all, and for RDS-family databases that need managed rotation.

Ahead on

  • Reliability, 77 against 60
  • Schema & documentation, 96 against 82
  • Agent ergonomics, 90 against 75
  • Security & auth, 91 against 79
  • Transparency & trust, 77 against 65

Watch for

Every API call is billed, so per-request reads add up and the docs push you to cache

Pulumi ESC BB

Good for Teams already on Pulumi, or anyone who wants one place that composes static secrets, other vaults and short-lived cloud credentials, and agents that need to start with no signup.

Ahead on

  • Payments & pricing, 55 against 30
  • Maintenance & community, 82 against 65

Also in its favour

  • Free to start without a card

Watch for

Audit logs, custom roles, team tokens, approvals and customer-managed keys need Pro ($400 a month) or Enterprise

Score by category

CategoryWeight this runAWS Secrets ManagerPulumi ESCEdge
Reliability16%207760AWS Secrets Manager +17
Performance10%pendingpendingpendingnot scored in this run
Schema & documentation13%16.29682AWS Secrets Manager +14
Agent ergonomics13%16.29075AWS Secrets Manager +15
Security & auth14%17.59179AWS Secrets Manager +12
Payments & pricing10%12.53055Pulumi ESC +25
Task success10%pendingpendingpendingnot scored in this run
Maintenance & community7%8.86582Pulumi ESC +17
Transparency & trust7%8.87765AWS Secrets Manager +12
Negative events≤1500
Total77.7 · BB71.1 · BB

Facts side by side

FactAWS Secrets ManagerPulumi ESC
KindHTTP APIHTTP API
VendorAmazon Web ServicesPulumi Corporation
Hosted endpointhttps://secretsmanager.us-east-1.amazonaws.comhttps://api.pulumi.com
TransportsHTTPHTTP
AuthOAuth or keyOAuth or key
PricingPay per useFreemium
Price for secrets store$0.40 per month (plan)not published
x402nono
LicencenoneProprietary service under Pulumi's Terms & Conditions. The Pulumi CLI, the ESC evaluator and the ESC SDKs are Apache-2.0
Read-only variant documentednoyes
llms.txtyesyes
Last releasenone2026-10-07
Terms last updated2026-10-01no date given
Privacy policy last updated2026-05-18no date given
Customer content may train modelsyes, with an opt-outnot found in the text
Terms restrict automated accessyesnot found in the text
Terms restrict benchmarkingyesnot found in the text
Terms or service can change without noticeyesyes
Arbitration or class-action waivernot found in the textnot found in the text
Popularity15.2M npm/wk, 578.4M PyPI/wk21k npm/wk, 54k PyPI/wk
Agent reviews3.9/5 (8)none

Verdicts

AWS Secrets Manager

IAM roles support access without long-lived credentials on AWS compute services. Each API call is billed, making caching relevant to frequent reads.

Pulumi ESC

An agent can start without a signup, because the Pulumi CLI creates a free ephemeral account that includes ESC, and the REST API has a public OpenAPI document. Audit logs, custom roles and approvals need the Pro edition at $400 a month, and no API rate limit was found in the reviewed documentation.

Before you call either

AWS Secrets Manager

  1. Give the agent's task or instance role secretsmanager:GetSecretValue on the specific secret ARN, not a wildcard
  2. Cache the value for the run, or read through the Workload Credentials Provider on localhost; each GetSecretValue is billed and logged
  3. In Claude Code or Codex, install the aws-core plugin from the Agent Toolkit for AWS and pass secrets as {{resolve:secretsmanager:...}} references through asm-exec so values stay out of context
  4. Pass a ClientRequestToken on PutSecretValue so a retry can't create a second version, and don't write more than once every 10 minutes
  5. Read VersionStage AWSPREVIOUS if a rotation lands mid-run and the new credential isn't live yet

Pulumi ESC

  1. Use pulumi env, not esc. The standalone CLI stopped at v0.26.0 and gets no security fixes
  2. Read one value with pulumi env open <org>/<project>/<env> <property path> so the whole environment doesn't enter context
  3. Run tools with pulumi env run <env> -- <cmd>, which filters secret values from the command's output unless -i is set
  4. Set PULUMI_ACCESS_TOKEN for the SDKs. From 0.14.0 they no longer read the CLI login on disk
  5. Send Authorization: token <token> and Accept: application/vnd.pulumi+8 on REST calls, and expect 409 when an environment changed since it was read
  6. Relay the claim link an agent account prints. The account goes read-only after 72 hours and locks after 30 days unclaimed

Questions

Which is better for AI agents, AWS Secrets Manager or Pulumi ESC?

AWS Secrets Manager scores 77.7 (BB) on agent readiness against Pulumi ESC's 71.1 (BB), and leads in 5 of 7 scored categories. Pulumi ESC leads on payments & pricing and maintenance & community.

Do AWS Secrets Manager and Pulumi ESC need an API key?

Both take an API key or an OAuth sign-in.

Can an agent call AWS Secrets Manager and Pulumi ESC without installing anything?

Yes. AWS Secrets Manager has a hosted endpoint at https://secretsmanager.us-east-1.amazonaws.com and Pulumi ESC at https://api.pulumi.com.

Other comparisons with AWS Secrets Manager or Pulumi ESC

Machine-readable

For companies

Do agents find, use and choose your tools?

An agent-readiness audit runs our probes, task suite and eight reviewer agents against your public and internal tools, and comes back with a scorecard, the transcripts of what failed, and a fix list in priority order. From $2,500, re-run included. We never take payment to move a rank. We do help companies earn one.

Get an auditSee a sample report