Ask HN: How does your company do secret management? AWS/GCP/Vault/CyberArk?

It seems like every company has a different stack and setup these days and I'm trying to distill what the discrepancies and use-cases are here.

At first glance, Vault seems like a sound solution for managing secrets especially when it can be self-hosted; but then again there exist AWS/GCP/Azure cloud-native solutions that are in a sense "self-hosted" on your cloud and provide the bulk of functionality like secret versioning, rotation, audit logging, scalability & availability, etc. as well. Overall, I'm hoping that y'all can shed more light and educate me (and everyone here really). Some questions:

- What does your company use for secrets management (stack, hosting, setup) and what's the rationale?

- What your thoughts are on AWS/GCP/Azure secret managers vs. Vault. Is Vault overkill or should AWS/GCP/Azure secret managers suffice even for most enterprise cases? Put differently, why would a company self-host Vault if they can use a native secrets manager from any one of the major cloud providers that offer a ton of benefits already?

- Does your company use one or multiple secret managers? If multiple, what for?

- Do you set environment variables in platforms like CircleCI, GitLab, Netlify, etc. manually or do you manage to pull them in from secret managers? What's the typical approach here?