If you're comfortable with using KMS already, I recommend checking out SOPS: https://github.com/mozilla/sops
It can be versioned if you use git, access controlled via the KMS access privileges, and easily plugs into other tools because it uses YAML. Simplicity is the killer feature.
In Strongbox: a secret manager for AWSgetsops
sops
Go2015–2026
getsops / sops
sops
Simple and flexible tool for managing secrets
81Distinct people
95Mentions
2Explicit recommenders
23.7KGitHub stars
What to know before exploring
What it is
Simple and flexible tool for managing secrets
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
I recommend against with using secrets managers as opposed to config files for storing configuration. Ideally, your configuration is versioned and code-reviewed. Config files…
xvector used a recommendation phrase. 2 indexed comments match. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
- agwa/git-crypt · linked in 4 of the same discussions
- filosottile/age · linked in 2 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 8:59:20 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year95 dated mentions
Observed mentions: 2015-11-01 16:14:34 UTC to 2026-08-28 16:57:09 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 4 | 2 | 2 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 4 | 1 | 3 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 5 | 2 | 3 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 6 | 1 | 5 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 14 | 2 | 12 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 4 | 1 | 3 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 9 | 2 | 7 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 15 | 1 | 14 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 16 | 0 | 16 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 9 | 2 | 7 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 8 | 0 | 8 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
SOPS: Secrets OPerationS
SOPS is an editor of encrypted files that supports YAML, JSON, ENV, INI and BINARY
formats and encrypts with AWS KMS, GCP KMS, Azure Key Vault, HuaweiCloud KMS, age, and PGP.
(demo)
Documentation
You can find the SOPS documentation on getsops.io under "Docs".
Security
Please report any security issues privately using GitHub's advisory form.
License
Mozilla Public License Version 2.0
Authors
SOPS was initially launched as a project at Mozilla in 2015 and has been
graciously donated to the CNCF as a Sandbox project in 2023, now under the
stewardship of a new group of maintainers.
The original authors of the project were:
Adrian Utrilla @autrilla
Julien Vehent @jvehent
Furthermore, the project has been carried for a long time by AJ Bahnken @ajvb,
and had not been possible without the contributions of numerous contributors.
Credits
SOPS was inspired by hiera-eyaml,
credstash,
sneaker,
password store and too many years managing
PGP encrypted files by hand...
We are a Cloud Native Computing Foundation sandbox project.
Read the full README on GitHubWhat Hacker News says
5 sourcesAnything secret involves a master key. If you don't trust AWS, then you need to supply your own master key. But for most setup, IMO, you should just let AWS handle the key management, and you use role to decrypt. Rotation is a big deal though. For server, SSH key can be encrypted in KMS and we either completely replace the box, or we rotate one box at a time. For DB servers, it's important to choose a DB that can stream data to a new box with as little impact as possible (or allows replication). But these takes time to develop (I can't use container to host DB or critical applications because the network performance, at least a year ago).
BTW Mozilla's sops [1] is quite interesting. I've been testing this for a while now.
[1]: https://github.com/mozilla/sops
In HashiCorp and Google: easing secret and infrastructure managementEncrypt only secret data, leaving file structure easy-t-read
3 points · Open discussionI wrote https://github.com/mozilla/sops to manage secrets in our deployments, and also use it as my personal password store, to encrypt a file stored in a private git repo.
In Ask HN: What is your password management solution?SOPS – an editor of encrypted files that encrypts with AWS KMS and PGP
1 points · Open discussion