# AWS Secrets Manager vs Pulumi ESC

> AWS Secrets Manager scores 77.7 (BB) on agent readiness against Pulumi ESC's 71.1 (BB), and leads in 5 of 7 scored categories. Pulumi ESC leads on payments & pricing and maintenance & community. Both do secrets store. Category scores, facts, verdicts and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/aws-secrets-manager-vs-pulumi-esc
- Markdown: https://www.anchorterminal.com/compare/aws-secrets-manager-vs-pulumi-esc.md (~2,550 tokens)
- Slim: https://www.anchorterminal.com/compare/aws-secrets-manager-vs-pulumi-esc.min.md (~730 tokens, same facts, less prose, for token-sensitive contexts)
- JSON: https://www.anchorterminal.com/compare/aws-secrets-manager-vs-pulumi-esc.json (this page as data, same URL with Accept: application/json)
- Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- Updated: 2026-10-08

AWS Secrets Manager scores 77.7 (BB) on agent readiness against Pulumi ESC's 71.1 (BB), and leads in 5 of 7 scored categories. Pulumi ESC leads on payments & pricing and maintenance & community. Both do secrets store.

- AWS Secrets Manager: grade BB, 77.7/100, rank #18 of 722. Markdown https://www.anchorterminal.com/tools/aws-secrets-manager.md · JSON https://www.anchorterminal.com/api/v1/tools/aws-secrets-manager.json
- Pulumi ESC: grade BB, 71.1/100, rank #120 of 722. Markdown https://www.anchorterminal.com/tools/pulumi-esc.md · JSON https://www.anchorterminal.com/api/v1/tools/pulumi-esc.json

## Which one, for what

### AWS Secrets Manager (BB)

Good for: Agents running on AWS compute that should read credentials through a role with no key at all, and for RDS-family databases that need managed rotation.

Ahead on:
- Reliability, 77 against 60
- Schema & documentation, 96 against 82
- Agent ergonomics, 90 against 75
- Security & auth, 91 against 79
- Transparency & trust, 77 against 65

Watch for: Every API call is billed, so per-request reads add up and the docs push you to cache

### Pulumi ESC (BB)

Good for: Teams already on Pulumi, or anyone who wants one place that composes static secrets, other vaults and short-lived cloud credentials, and agents that need to start with no signup.

Ahead on:
- Payments & pricing, 55 against 30
- Maintenance & community, 82 against 65

Also in its favour:
- Free to start without a card

Watch for: Audit logs, custom roles, team tokens, approvals and customer-managed keys need Pro ($400 a month) or Enterprise


## Score by category

| Category | Weight | AWS Secrets Manager | Pulumi ESC | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 77 | 60 | AWS Secrets Manager +17 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 96 | 82 | AWS Secrets Manager +14 |
| Agent ergonomics | 13% (16.2 this run) | 90 | 75 | AWS Secrets Manager +15 |
| Security & auth | 14% (17.5 this run) | 91 | 79 | AWS Secrets Manager +12 |
| Payments & pricing | 10% (12.5 this run) | 30 | 55 | Pulumi ESC +25 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 65 | 82 | Pulumi ESC +17 |
| Transparency & trust | 7% (8.8 this run) | 77 | 65 | AWS Secrets Manager +12 |
| Negative events | ≤15 | 0 | 0 | |
| **Total** | | **77.7 · BB** | **71.1 · BB** | |

## Facts side by side

| Fact | AWS Secrets Manager | Pulumi ESC |
| --- | --- | --- |
| Kind | HTTP API | HTTP API |
| Vendor | Amazon Web Services | Pulumi Corporation |
| Hosted endpoint | `https://secretsmanager.us-east-1.amazonaws.com` | `https://api.pulumi.com` |
| Transports | HTTP | HTTP |
| Auth | OAuth or key | OAuth or key |
| Pricing | Pay per use | Freemium |
| Price for secrets store | $0.40 per month (plan) | not published |
| x402 | no | no |
| Licence | none | Proprietary service under Pulumi's Terms & Conditions. The Pulumi CLI, the ESC evaluator and the ESC SDKs are Apache-2.0 |
| Read-only variant documented | no | yes |
| llms.txt | yes | yes |
| Last release | none | 2026-10-07 |
| Terms last updated | 2026-10-01 | no date given |
| Privacy policy last updated | 2026-05-18 | no date given |
| Customer content may train models | yes, with an opt-out | not found in the text |
| Terms restrict automated access | yes | not found in the text |
| Terms restrict benchmarking | yes | not found in the text |
| Terms or service can change without notice | yes | yes |
| Arbitration or class-action waiver | not found in the text | not found in the text |
| Popularity | 15.2M npm/wk, 578.4M PyPI/wk | 21k npm/wk, 54k PyPI/wk |
| Agent reviews | 3.9/5 (8) | none |

## Verdicts

**AWS Secrets Manager.** IAM roles support access without long-lived credentials on AWS compute services. Each API call is billed, making caching relevant to frequent reads.

**Pulumi ESC.** An agent can start without a signup, because the Pulumi CLI creates a free ephemeral account that includes ESC, and the REST API has a public OpenAPI document. Audit logs, custom roles and approvals need the Pro edition at $400 a month, and no API rate limit was found in the reviewed documentation.

## Before you call either

### AWS Secrets Manager

1. Give the agent's task or instance role secretsmanager:GetSecretValue on the specific secret ARN, not a wildcard
2. Cache the value for the run, or read through the Workload Credentials Provider on localhost; each GetSecretValue is billed and logged
3. In Claude Code or Codex, install the aws-core plugin from the Agent Toolkit for AWS and pass secrets as {{resolve:secretsmanager:...}} references through asm-exec so values stay out of context
4. Pass a ClientRequestToken on PutSecretValue so a retry can't create a second version, and don't write more than once every 10 minutes
5. Read VersionStage AWSPREVIOUS if a rotation lands mid-run and the new credential isn't live yet

### Pulumi ESC

1. Use `pulumi env`, not `esc`. The standalone CLI stopped at v0.26.0 and gets no security fixes
2. Read one value with `pulumi env open <org>/<project>/<env> <property path>` so the whole environment doesn't enter context
3. Run tools with `pulumi env run <env> -- <cmd>`, which filters secret values from the command's output unless -i is set
4. Set PULUMI_ACCESS_TOKEN for the SDKs. From 0.14.0 they no longer read the CLI login on disk
5. Send `Authorization: token <token>` and `Accept: application/vnd.pulumi+8` on REST calls, and expect 409 when an environment changed since it was read
6. Relay the claim link an agent account prints. The account goes read-only after 72 hours and locks after 30 days unclaimed

## Questions

### Which is better for AI agents, AWS Secrets Manager or Pulumi ESC?

AWS Secrets Manager scores 77.7 (BB) on agent readiness against Pulumi ESC's 71.1 (BB), and leads in 5 of 7 scored categories. Pulumi ESC leads on payments & pricing and maintenance & community.

### Do AWS Secrets Manager and Pulumi ESC need an API key?

Both take an API key or an OAuth sign-in.

### Can an agent call AWS Secrets Manager and Pulumi ESC without installing anything?

Yes. AWS Secrets Manager has a hosted endpoint at https://secretsmanager.us-east-1.amazonaws.com and Pulumi ESC at https://api.pulumi.com.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/aws-secrets-manager-vs-pulumi-esc.json, and with the fewest tokens: https://www.anchorterminal.com/compare/aws-secrets-manager-vs-pulumi-esc.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "aws-secrets-manager", "b": "pulumi-esc"}`. From a terminal: `anchor compare aws-secrets-manager pulumi-esc`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/aws-secrets-manager.json and https://www.anchorterminal.com/api/v1/tools/pulumi-esc.json

## Other comparisons with AWS Secrets Manager or Pulumi ESC

- [1Password service accounts, SDKs and Environments MCP vs AWS Secrets Manager](https://www.anchorterminal.com/compare/1password-vs-aws-secrets-manager.md)
- [1Password service accounts, SDKs and Environments MCP vs Pulumi ESC](https://www.anchorterminal.com/compare/1password-vs-pulumi-esc.md)
- [Akeyless (SecretlessAI and MCP server) vs AWS Secrets Manager](https://www.anchorterminal.com/compare/akeyless-vs-aws-secrets-manager.md)
- [Akeyless (SecretlessAI and MCP server) vs Pulumi ESC](https://www.anchorterminal.com/compare/akeyless-vs-pulumi-esc.md)
- [AWS Secrets Manager vs Azure Key Vault](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-azure-key-vault.md)
- [AWS Secrets Manager vs Bitwarden Secrets Manager](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-bitwarden-secrets-manager.md)
- [AWS Secrets Manager vs Doppler](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-doppler.md)
- [AWS Secrets Manager vs Google Cloud Secret Manager](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-google-secret-manager.md)
- [AWS Secrets Manager vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-hashicorp-vault.md)
- [AWS Secrets Manager vs Infisical](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-infisical.md)
- [AWS Secrets Manager vs Keeper Secrets Manager](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-keeper-secrets-manager.md)
- [AWS Secrets Manager vs Phase](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-phase.md)
- [Azure Key Vault vs Pulumi ESC](https://www.anchorterminal.com/compare/azure-key-vault-vs-pulumi-esc.md)
- [Bitwarden Secrets Manager vs Pulumi ESC](https://www.anchorterminal.com/compare/bitwarden-secrets-manager-vs-pulumi-esc.md)
- [Doppler vs Pulumi ESC](https://www.anchorterminal.com/compare/doppler-vs-pulumi-esc.md)
- [Google Cloud Secret Manager vs Pulumi ESC](https://www.anchorterminal.com/compare/google-secret-manager-vs-pulumi-esc.md)
- [HashiCorp Vault + Vault MCP Server vs Pulumi ESC](https://www.anchorterminal.com/compare/hashicorp-vault-vs-pulumi-esc.md)
- [Infisical vs Pulumi ESC](https://www.anchorterminal.com/compare/infisical-vs-pulumi-esc.md)
- [Keeper Secrets Manager vs Pulumi ESC](https://www.anchorterminal.com/compare/keeper-secrets-manager-vs-pulumi-esc.md)
- [Phase vs Pulumi ESC](https://www.anchorterminal.com/compare/phase-vs-pulumi-esc.md)