AWS Secrets Manager vs CyberArk Conjur: Which Alternative is Best? (2026)

AWS Secrets Manager is a fully managed cloud service and does not support self-hosting or offline operation. For local development, you can mock the Secrets Manager API or use environment variables, but the actual service requires internet connectivity and AWS infrastructure.

Community insight informed by Reddit discussions

Secrets stored in AWS Secrets Manager are encrypted at rest using AWS KMS (Key Management Service) keys. You retain ownership and control of the encryption keys if you use customer-managed KMS keys, ensuring that only authorized IAM principals can decrypt and access secrets. AWS does not have access to the plaintext secrets without your permission.

Community insight informed by StackOverflow discussions

Yes, AWS Secrets Manager enforces API rate limits, typically around 40 requests per second per account per region, which can impact applications with very high secret access frequency. Additionally, costs can increase significantly with many API calls due to per-API-call pricing, so caching secrets locally or using AWS SDK caching mechanisms is recommended to reduce calls and control expenses.

Community insight informed by Hacker News discussions

AWS Secrets Manager does not provide a native bulk export feature for secrets due to security reasons. To migrate secrets, you typically write scripts using AWS SDKs to programmatically retrieve each secret and then securely transfer it to the target system. Care must be taken to handle secrets securely during export and import to avoid exposure.

Community insight informed by Forums discussions

Self-hosting CyberArk Conjur requires a solid understanding of Kubernetes or OpenShift, as it is typically deployed as a containerized service. The setup involves configuring high availability, integrating with existing identity providers, and managing network policies for secure access. While CyberArk provides Helm charts and operator support to ease deployment, initial configuration and tuning can be complex, especially in hybrid cloud scenarios where connectivity and security policies vary between on-prem and cloud environments.

Community insight informed by Reddit discussions

CyberArk Conjur can be configured to operate in air-gapped or offline environments, but it requires manual setup of all dependencies and careful synchronization of policies and secrets. Since Conjur relies on API calls for secret retrieval, clients must be able to communicate with the Conjur server within the isolated network. There is no built-in offline caching mechanism for secrets, so applications need persistent connectivity to Conjur for real-time secret access.

Community insight informed by Hacker News discussions

All secrets and credentials stored in CyberArk Conjur remain under the customer's ownership. Data is encrypted at rest using AES-256 encryption and in transit via TLS. Conjur supports role-based access control (RBAC) and policy-driven governance to restrict access to secrets. Additionally, audit logs are maintained to track all access and changes, ensuring compliance and traceability for enterprise environments.

Community insight informed by Forums discussions

CyberArk Conjur APIs are designed for high concurrency and automation but do have practical rate limits to protect the service from abuse. While exact limits are not publicly documented, typical usage patterns in CI/CD pipelines are supported without issue. For extremely high-volume environments, it is recommended to deploy Conjur in a highly available configuration and monitor API usage. Additionally, token lifetimes and renewal policies should be configured to optimize performance and security.

Community insight informed by StackOverflow discussions

Migrating secrets to CyberArk Conjur typically involves exporting secrets from legacy vaults in a structured format (e.g., JSON or CSV) and then importing them using Conjur's CLI or API. CyberArk provides tooling and scripts to facilitate bulk secret imports, but customers often need to customize these to fit their existing data formats and policies. It is important to validate and test the imported secrets and associated policies in a staging environment before production rollout.

Community insight informed by Reddit discussions