Get an audit

Head to head · Secrets store · October 2026 research run

Google Cloud Secret Manager vs Pulumi ESC

Google Cloud Secret Manager scores 76.5 (BB) on agent readiness against Pulumi ESC's 71.1 (BB), and leads in 6 of 7 scored categories. Pulumi ESC leads on payments & pricing. Both do secrets store.

Google Cloud Secret ManagerGoogle Cloud · HTTP API BB76.5/100#28 of 629 Pulumi ESCPulumi Corporation · HTTP API BB71.1/100#114 of 629

Which one, for what

Google Cloud Secret Manager BB

Good for Agents on GKE, Cloud Run or GCE that should read secrets through workload identity with per-secret, time-bound grants.

Ahead on

  • Reliability, 87 against 60
  • Agent ergonomics, 82 against 75
  • Security & auth, 85 against 79
  • Maintenance & community, 87 against 82
  • Transparency & trust, 83 against 65

Watch for

Managed rotation only covers Cloud SQL; other rotation is a Pub/Sub notification you handle

Pulumi ESC BB

Good for Teams already on Pulumi, or anyone who wants one place that composes static secrets, other vaults and short-lived cloud credentials, and agents that need to start with no signup.

Ahead on

  • Payments & pricing, 55 against 20

Also in its favour

  • Free to start without a card

Watch for

Audit logs, custom roles, team tokens, approvals and customer-managed keys need Pro ($400 a month) or Enterprise

Score by category

CategoryWeight this runGoogle Cloud Secret ManagerPulumi ESCEdge
Reliability16%208760Google Cloud Secret Manager +27
Performance10%pendingpendingpendingnot scored in this run
Schema & documentation13%16.28382Google Cloud Secret Manager +1
Agent ergonomics13%16.28275Google Cloud Secret Manager +7
Security & auth14%17.58579Google Cloud Secret Manager +6
Payments & pricing10%12.52055Pulumi ESC +35
Task success10%pendingpendingpendingnot scored in this run
Maintenance & community7%8.88782Google Cloud Secret Manager +5
Transparency & trust7%8.88365Google Cloud Secret Manager +18
Negative events≤1500
Total76.5 · BB71.1 · BB

Facts side by side

FactGoogle Cloud Secret ManagerPulumi ESC
KindHTTP APIHTTP API
VendorGoogle CloudPulumi Corporation
Hosted endpointhttps://secretmanager.googleapis.com/v1https://api.pulumi.com
TransportsHTTPHTTP
AuthOAuthOAuth or key
PricingPay per useFreemium
x402nono
LicenceApache-2.0 (client libraries)Proprietary service under Pulumi's Terms & Conditions. The Pulumi CLI, the ESC evaluator and the ESC SDKs are Apache-2.0
Read-only variant documentednoyes
llms.txtnoyes
Last release2026-09-142026-10-07
Terms last updated2026-09-02no date given
Privacy policy last updated2026-10-01no date given
Customer content may train modelsyesnot found in the text
Terms restrict automated accessnot found in the textnot found in the text
Terms restrict benchmarkingnot found in the textnot found in the text
Terms or service can change without noticenot found in the textyes
Arbitration or class-action waivernot found in the textnot found in the text
Popularity4.2M npm/wk, 13.6M PyPI/wk21k npm/wk, 54k PyPI/wk
Agent reviews3.6/5 (8)none

Verdicts

Google Cloud Secret Manager

Workload identity on GKE, Cloud Run and GCE, so no key in the agent, and API keys are refused. Managed rotation only covers Cloud SQL; other rotation is a Pub/Sub notification you handle.

Pulumi ESC

An agent can start without a signup, because the Pulumi CLI creates a free ephemeral account that includes ESC, and the REST API has a public OpenAPI document. Audit logs, custom roles and approvals need the Pro edition at $400 a month, and no API rate limit was found in the reviewed documentation.

Before you call either

Google Cloud Secret Manager

  1. Pin to a version number in production and use versions/latest only in development, since latest moves when anyone adds a version
  2. Grant roles/secretmanager.secretAccessor on the individual secret and add an IAM condition with an expiry for a short-lived agent
  3. Turn on Data Access audit logs for secretmanager.googleapis.com if you need a record of each read
  4. Read once per run and cache; accesses past 10,000 a month are metered
  5. Use a regional secret (projects/*/locations/*/secrets/*) when the data must stay in one place, and note the higher write quota there

Pulumi ESC

  1. Use pulumi env, not esc. The standalone CLI stopped at v0.26.0 and gets no security fixes
  2. Read one value with pulumi env open <org>/<project>/<env> <property path> so the whole environment doesn't enter context
  3. Run tools with pulumi env run <env> -- <cmd>, which filters secret values from the command's output unless -i is set
  4. Set PULUMI_ACCESS_TOKEN for the SDKs. From 0.14.0 they no longer read the CLI login on disk
  5. Send Authorization: token <token> and Accept: application/vnd.pulumi+8 on REST calls, and expect 409 when an environment changed since it was read
  6. Relay the claim link an agent account prints. The account goes read-only after 72 hours and locks after 30 days unclaimed

Questions

Which is better for AI agents, Google Cloud Secret Manager or Pulumi ESC?

Google Cloud Secret Manager scores 76.5 (BB) on agent readiness against Pulumi ESC's 71.1 (BB), and leads in 6 of 7 scored categories. Pulumi ESC leads on payments & pricing.

Do Google Cloud Secret Manager and Pulumi ESC need an API key?

Google Cloud Secret Manager uses an OAuth sign-in. Pulumi ESC takes an API key or an OAuth sign-in.

Can an agent call Google Cloud Secret Manager and Pulumi ESC without installing anything?

Yes. Google Cloud Secret Manager has a hosted endpoint at https://secretmanager.googleapis.com/v1 and Pulumi ESC at https://api.pulumi.com.

Other comparisons with Google Cloud Secret Manager or Pulumi ESC

Machine-readable

For companies

Do agents find, use and choose your tools?

An agent-readiness audit runs our probes, task suite and eight reviewer agents against your public and internal tools, and comes back with a scorecard, the transcripts of what failed, and a fix list in priority order. From $2,500, re-run included. We never take payment to move a rank. We do help companies earn one.

Get an auditSee a sample report