what should I use for secrets management in a SaaS platform

For a SaaS platform, a good secrets-management setup is usually a combination of:

1. A centralized secrets manager
2. Short-lived credentials where possible
3. Strong access controls and audit logging
4. Automated rotation
5. Separate handling for app secrets, infrastructure secrets, and customer data encryption keys

Common good choices

Managed cloud secrets managers

Best default for most SaaS teams if you’re on a major cloud:

• AWS Secrets Manager + AWS KMS
• HashiCorp Vault (especially if you need multi-cloud/on-prem or advanced dynamic secrets)
• GCP Secret Manager + Cloud KMS
• Azure Key Vault

When to choose what

• AWS/GCP/Azure native secret manager: simplest if you’re mostly on one cloud.
• Vault: best when you need:
  • multi-cloud or hybrid support
  • dynamic database credentials
  • advanced leasing/rotation
  • tighter control over secret lifecycle

What I’d recommend for a typical SaaS

If you’re cloud-native and want simpler ops

Use:

• Cloud provider secret manager
• Cloud KMS
• IAM/workload identity
• Automated rotation
• No secrets in code or CI variables unless absolutely necessary

If you need stronger enterprise-grade control or multi-cloud

Use:

• HashiCorp Vault
• Back it with your cloud KMS/HSM
• Use dynamic secrets for databases and service accounts

Best practices

• Prefer short-lived tokens over long-lived API keys
• Use workload identity / IAM roles instead of static cloud credentials
• Store secrets in a dedicated secret manager, not env files or git
• Enable audit logs and alert on unusual access
• Rotate secrets regularly and on incident
• Encrypt secrets at rest with KMS-managed keys
• Separate environments: dev / staging / prod
• Consider customer-specific encryption keys if you handle sensitive tenant data

What not to use

• .env files checked into repos
• plaintext configs in containers or Terraform state
• CI secrets as a long-term store
• ad hoc spreadsheets/password managers for app secrets

Practical stack example

A solid SaaS setup might look like:

• App secrets: AWS Secrets Manager
• Key encryption: AWS KMS
• Database access: IAM auth or Vault dynamic DB creds
• Service-to-service auth: OIDC/JWT short-lived tokens
• CI/CD: secrets injected at runtime only

If you tell me:

• your cloud provider,
• whether you’re multi-cloud,
• and whether you need dynamic DB creds/rotation,

I can recommend a specific setup.