Vault et secrets management

[khalilbenaz]

---

lede: HashiCorp Vault, AWS Secrets Manager, Doppler, Infisical. Choisir et opérer une solution secrets management en 2026.
lede_en: HashiCorp Vault, AWS Secrets Manager, Doppler, Infisical. Choose and operate a secrets management solution in 2026.
title_en: Vault and secrets management

Le besoin secrets management

Chaque app a des secrets : DB passwords, API keys, tokens. Stockés où ?

❌ Hardcodés dans le code.
❌ Dans .env commit dans git.
❌ Email/Slack aux devs.

✅ Solution dédiée : Vault, Secrets Manager, Doppler.

HashiCorp Vault

Référence enterprise. OSS + commercial.

vault kv put secret/db password=xyz
vault kv get secret/db

Features :

• Encryption at rest, in transit.
• Dynamic secrets : génère credentials short-lived (ex: DB user pour 1h).
• Audit log complet.
• Auth methods : OIDC, AppRole, K8s service accounts.
• HA mode.

Cher à opérer self-host (cluster Consul/Raft). HCP Vault (managed) plus simple.

AWS Secrets Manager

Si vous êtes AWS-native :

import { SecretsManagerClient, GetSecretValueCommand } from "@aws-sdk/client-secrets-manager";

const client = new SecretsManagerClient();
const response = await client.send(new GetSecretValueCommand({ SecretId: "my-db-password" }));

Intégration IAM, rotation auto pour RDS. Pricing par secret + API calls.

Sweet spot : AWS-only stacks.

Doppler

SaaS modern, focus DX.

doppler setup
doppler run -- npm start

Doppler injecte les secrets comme env vars au runtime. Pas de fichier .env.

Features :

• UI claire pour manager environments.
• Webhooks pour sync vers Vercel, Netlify.
• Audit log.

Pricing : $0 free tier, payant à partir de 3 users.

Infisical

OSS alternative à Doppler. Self-host gratuit ou cloud managed.

infisical secrets get DB_PASSWORD

Sweet spot : équipes voulant Doppler-like DX sans SaaS US.

Decision tree

AWS-only stack ?
  → AWS Secrets Manager.

Enterprise, compliance lourde ?
  → Vault (HCP managed).

Startup, DX max ?
  → Doppler ou Infisical.

Free tier OK + self-host willing ?
  → Infisical self-host.

Compliance EU stricte ?
  → Infisical self-host EU ou Vault HCP EU.

Anti-patterns

• Secrets in env files committed : even .env.example with real values.
• Hardcoded keys in code : impossible à rotate.
• Pas de rotation : keys vieilles de 5 ans encore actives.
• Pas d'audit log : impossible de tracer compromise.

Verdict

Pour toute app sérieuse en 2026 : secrets management dédié non-négociable.

Startups : Doppler ou Infisical. Enterprises : Vault. AWS-pure : Secrets Manager.

The secrets management need

Every app has secrets: DB passwords, API keys, tokens. Stored where?

❌ Hardcoded in code.
❌ In .env committed to git.
❌ Email/Slack to devs.

✅ Dedicated solution: Vault, Secrets Manager, Doppler.

HashiCorp Vault

Enterprise reference. OSS + commercial.

vault kv put secret/db password=xyz
vault kv get secret/db

Features:

• Encryption at rest, in transit.
• Dynamic secrets: generates short-lived credentials (e.g., DB user for 1h).
• Complete audit log.
• Auth methods: OIDC, AppRole, K8s service accounts.
• HA mode.

Expensive to self-host (Consul/Raft cluster). HCP Vault (managed) simpler.

AWS Secrets Manager

If you're AWS-native:

import { SecretsManagerClient, GetSecretValueCommand } from "@aws-sdk/client-secrets-manager";

const client = new SecretsManagerClient();
const response = await client.send(new GetSecretValueCommand({ SecretId: "my-db-password" }));

IAM integration, auto rotation for RDS. Pricing per secret + API calls.

Sweet spot: AWS-only stacks.

Doppler

Modern SaaS, DX focus.

doppler setup
doppler run -- npm start

Doppler injects secrets as env vars at runtime. No .env file.

Features:

• Clear UI to manage environments.
• Webhooks to sync to Vercel, Netlify.
• Audit log.

Pricing: $0 free tier, paid from 3 users.

Infisical

OSS Doppler alternative. Free self-host or managed cloud.

infisical secrets get DB_PASSWORD

Sweet spot: teams wanting Doppler-like DX without US SaaS.

Decision tree

AWS-only stack?
  → AWS Secrets Manager.

Enterprise, heavy compliance?
  → Vault (managed HCP).

Startup, max DX?
  → Doppler or Infisical.

Free tier OK + willing self-host?
  → Infisical self-host.

Strict EU compliance?
  → Infisical EU self-host or HCP Vault EU.

Anti-patterns

• Secrets in committed env files: even .env.example with real values.
• Hardcoded keys in code: impossible to rotate.
• No rotation: 5-year-old keys still active.
• No audit log: impossible to trace compromise.

Verdict

For any serious 2026 app: dedicated secrets management non-negotiable.

Startups: Doppler or Infisical. Enterprises: Vault. Pure AWS: Secrets Manager.

[MikeGarciaAGM]

Implemented and opened PR for this issue: #339

Scope:

• add issue content to posts.json as a new post entry
• preserve existing structure/order