Pulumi ESC vs HashiCorp Vault
Choosing the right secrets management tool is important, and we want you to have as much information as possible to make the choice that best suits your needs. We’ve created this document to help you understand how Pulumi ESC compares with HashiCorp Vault, and how ESC and Vault can be used together.
What is HashiCorp Vault?
HashiCorp Vault is a secrets management tool that provides a centralized platform for managing and controlling access to secrets. It supports dynamic secret generation, encryption as a service, and comprehensive access policies.
Pulumi ESC vs. Vault: Similarities
Like Vault, Pulumi ESC is a secrets manager for cloud applications and infrastructure. In both ESC and Vault, secrets can be stored and accessed through a CLI, SDK, or editor interface. Granular access controls can be implemented across all secrets.
Pulumi ESC vs. Vault: Key differences
Vault and Pulumi ESC differ in three fundamental ways. First, Vault is not open source: it uses the Business Source License model, whereas ESC is fully open source and Apache 2.0 licensed. Second, Vault stores secrets only, whereas ESC stores environments, secrets, and configurations. Third, ESC provides composability of collections of secrets and configuration: environments can be composed together from multiple other environments, so shared configuration is inherited rather than duplicated.
Pulumi ESC and Vault: Better together
Pulumi ESC and Vault can be used together to store and manage infrastructure and application secrets. ESC environments can reference secrets stored in Vault, and through ESC those secrets can be organized as collections that are versioned, branched, and composed inside other collections. ESC also stores non-secret configuration alongside the secrets you keep in Vault.
Here is a summary of the key differences between Pulumi ESC and HashiCorp Vault:
| Feature | Pulumi ESC | Vault |
|---|---|---|
| Architecture | ||
| Open source license | Yes, Apache License 2.0 | No, Business Source License 1.1 |
| Hosting/management | Fully managed SaaS service provided by Pulumi Cloud | Offers hosted cloud service and self-hosting, which requires significant management overhead |
| Key-value store | Yes | Yes |
| Open ecosystem | Yes, supports pulling and using secrets from multiple sources including HashiCorp Vault, 1Password, AWS Secrets Manager, etc. | No, can only store and manage secrets stored in Vault |
| Developer experience | ||
| Editing and authoring | Yes, supports both GUI and powerful Document Editor with autocomplete, docs hover, and error checking | Limited, offers a key/value form editor with a JSON toggle |
| CLI | Yes, available as pulumi env in the Pulumi CLI. Supports injecting application secrets as environment variables and modifying secrets. | Limited, the vault CLI reads and writes secrets but does not inject them as environment variables. Vault Agent's process supervisor mode covers that separately. |
| Client SDKs | Yes | Yes |
| Declarative provider | Yes, support via the Pulumi Service Provider, which allows management (create, update, delete) of collections of secrets and configuration as a resource through infrastructure as code. | Yes, individual secrets can be managed as resources with the Vault provider for Pulumi or Terraform |
| Composability | Yes, hierarchical environments inherit values from the environments they import | No equivalent concept; secrets are organized by path convention and the structure is maintained by hand |
| Versioning | Yes, entire environments can be versioned and tagged and imported based on the specific version tags or revision numbers | Limited, secrets are individually versioned |
| Values can be secret or plaintext | Yes | No, values can only be secrets |
| Ability to see existing secrets | Yes | Yes, secret values can be read back by path with vault kv get, the UI, or the HTTP API |
| Secret referencing | Yes, environments can import secrets from another environment. Secrets updated from the referenced environment will automatically propagate to downstream environments | No equivalent concept; Vault has no first-class environment to reference, so secrets are read by path |
| Interpolate values from other values | Yes, new dynamic values can be constructed through string interpolation | No |
| Branching and personal configs | Yes, environments can be forked for testing without rewriting entire environments and overriding specific values | No |
| Compare secrets across environments | Yes, pulumi env diff shows the changes between two environments or two versions of a single environment | No |
| Built-in functions | Yes, support for functions like toJSON, fromJSON, fromBase64, and toString allows data manipulation for any scenario | Limited, provides templating and transformation functions, such as username templating and the Transform secrets engine, rather than functions for composing configuration values |
| Security and compliance | ||
| Audit logs | Yes | Yes |
| Encrypted secrets storage | Yes, TLS is used for encryption in transit and unique encryption keys per environment are employed for encryption at rest. | Yes, Vault uses a security barrier for all requests made to the backend. The security barrier automatically encrypts all data leaving Vault using a 256-bit Advanced Encryption Standard (AES) cipher in the Galois Counter Mode (GCM) with 96-bit nonces. |
| Access controls | Yes | Yes |
| Secure dynamic cloud provider credentials | Yes, uses OIDC flows to generate dynamic credentials. Available for AWS, Azure, and Google Cloud. | Yes, cloud secrets engines generate short-lived credentials for AWS, Azure, and Google Cloud. Each engine is configured with a static credential that Vault uses to mint them. |
| OIDC provider | Yes, Pulumi Cloud can be used as an OIDC provider from the Pulumi SDK, CLI, UI, and pulumi-service provider. | Yes, Vault can act as an OIDC provider, configurable from the UI, CLI, and API |
Get Started with Pulumi
Use Pulumi ESC to easily centralize and manage environments, secrets, and configurations. Follow our Get Started guide for ESC to begin. If you want to use Vault or any other secrets manager with ESC, follow the below guides to import secrets from existing secrets managers into ESC environments.
