Cloud & Infrastructure · head to head
Vault vs Lambda (AWS Serverless)
Vault
Cloud & Infrastructure
Manage Secrets and Protect Sensitive Data
- From
- Free
- Rated
- -
Lambda (AWS Serverless)
Cloud & Infrastructure
Run code without thinking about servers
- From
- Free
- Rated
- -
The short version
- Each has a real cost: Vault vault 1.15.0 and later is licensed under the Business Source License 1.1, not an OSI open source licence, with IBM Corporation as licensor; Lambda (AWS Serverless) billed on two axes at once, $0.20 per million requests plus $0.0000166667 per GB-second of duration, so memory settings change the bill as much as traffic does
- They diverge on capability: Vault covers Secrets management, Lambda (AWS Serverless) covers Function-as-a-Service.
Where they differ
Only the attributes on which Vault and Lambda (AWS Serverless) actually diverge.
| Attribute | Vault | Lambda (AWS Serverless) |
|---|---|---|
| Pricing model | open-source | usage-based |
| Platforms | Linux, Windows, Mac, Cloud | Web, Api |
| Founded | 2015 | 2014 |
Identical on both: starting price (Free), free tier (Yes), user rating (Not yet rated), category (Cloud & Infrastructure).
What each one covers
Drawn from each product's published feature list. An absence here means we hold no record of it - not that the product lacks it.
Only in Vault
- Secrets management
- Authentication
- Authorization
- Audit logging
- API access
- High availability
- Replication
- Kubernetes
Only in Lambda (AWS Serverless)
- Function-as-a-Service
- Event-driven execution
- Auto-scaling
- Pay-per-use
- Multiple languages
- Concurrency limits
- Dead Letter Queues
- Environment variables
Both cover
- Encryption
- Encryption
- Cloud deployment
What people use each for
The jobs each tool is most often brought in to do.
Vault
- Centrally storing and rotating secrets, API keys and database credentialsnot Lambda (AWS Serverless)
- Issuing short-lived dynamic credentials to applications instead of static passwordsnot Lambda (AWS Serverless)
- Encryption as a service and PKI certificate issuancenot Lambda (AWS Serverless)
Lambda (AWS Serverless)
- Event-driven functions without managing serversnot Vault
- API backends behind API Gatewaynot Vault
- Processing S3, DynamoDB, SQS and Kinesis eventsnot Vault
- Scheduled jobs without a always-on instancenot Vault
- Edge compute through Lambda@Edgenot Vault
Where each one falls short
Documented limitations, not opinions. Every one is a constraint you would hit in normal use.
Vault
- Vault 1.15.0 and later is licensed under the Business Source License 1.1, not an OSI open source licence, with IBM Corporation as licensor
- The Additional Use Grant forbids offering Vault to third parties on a hosted or embedded basis in a paid product that competes with IBM's paid versions of Vault
- Each version only converts to MPL 2.0 four years after that version is published, and the Change Date is tracked per version
- Replication, HSM support, namespaces, performance standby nodes, FIPS builds, control group authorisation, multi-factor authentication, secrets sync and lease count quotas all require a Vault Enterprise licence
- A Vault Enterprise licence must be applied to the cluster before any Enterprise feature can be used
Lambda (AWS Serverless)
- Billed on two axes at once, $0.20 per million requests plus $0.0000166667 per GB-second of duration, so memory settings change the bill as much as traffic does
- Provisioned concurrency, used to avoid cold starts, is charged separately at $0.0000041667 per GB-second whether or not the function runs
- Ephemeral storage beyond the included 512 MB is metered
- Lambda@Edge costs $0.60 per million requests, three times the standard request rate
- VPC use and cross-region data transfer carry EC2 charges on top
Pricing, plan by plan
Vault
Free- Open SourceFree
- Secrets management
- Encryption as a service
- Identity management
- EnterpriseFree
- Advanced features
- Premium support
- Dedicated updates
Lambda (AWS Serverless)
Free- Free TierFree
- 1M free requests/month
- 400,000 GB-seconds/month
- Always free
Which should you pick?
Choose Vault if
- You need secrets management.
- You want to start without paying.
- You work on Linux, Windows, Mac, Cloud.
- You also want authentication.
Choose Lambda (AWS Serverless) if
- You need function-as-a-service.
- You want to start without paying.
- You work on Web, Api.
- You also want event-driven execution.
Questions people ask
- Is Vault or Lambda (AWS Serverless) better?
- Neither clearly leads. Vault starts at Free and Lambda (AWS Serverless) at Free, and user ratings are close enough to be indistinguishable. Choose on capability and platform support.
- Which is cheaper, Vault or Lambda (AWS Serverless)?
- Vault starts at Free and Lambda (AWS Serverless) at Free.
- Does Vault or Lambda (AWS Serverless) run on more platforms?
- Vault runs on Linux, Windows, Mac, Cloud. Lambda (AWS Serverless) runs on Web, Api.
- Can I use Vault for free?
- Both have a free tier, so you can try either at no cost before committing.
- What is Vault best used for?
- Vault is most often used for centrally storing and rotating secrets, api keys and database credentials, issuing short-lived dynamic credentials to applications instead of static passwords, encryption as a service and pki certificate issuance. Of those, centrally storing and rotating secrets, api keys and database credentials and issuing short-lived dynamic credentials to applications instead of static passwords are not what Lambda (AWS Serverless) is typically brought in for.
- What can Vault do that Lambda (AWS Serverless) cannot?
- Vault covers Secrets management, Authentication, Authorization, Audit logging. Lambda (AWS Serverless) covers Function-as-a-Service, Event-driven execution, Auto-scaling, Pay-per-use. Both handle Encryption, Encryption, Cloud deployment.