Oracle Cloud Infrastructure Secret Management

oracle.com

Free plan WebAPI

Spec score 8.2 #3 of 24 in Encryption Key Management Software

What it is

Oracle Cloud Infrastructure Secret Management stores, retrieves, rotates, and manages credentials used by applications and cloud environments. It supports database passwords, access tokens, third-party API keys, SSH private keys, application configuration secrets, and OAuth2 or JWT signing credentials. Administrators and applications can access secrets through APIs, SDKs, the CLI, and OCI Console. OCI Vault keys encrypt secrets, while OCI manages encryption, decryption, access control, and audit logging; OCI IAM policies provide granular permissions. Automatic rotation can run at intervals from one to 12 months and integrates with Autonomous AI Database and OCI Functions. Secrets can be replicated to as many as three destination regions, where replicas are read-only and inherit changes from the source. A tenancy can contain up to 5,000 secrets, with up to 30 active versions and 30 versions pending deletion per secret. The service is aimed at applications and cloud environments that need centrally managed secrets rather than credentials embedded in source code or configuration files. It is listed as free, though no price is provided.

Spec sheet

What it does: OCI Secret Management stores, retrieves, rotates, and manages passwords, API keys, tokens, certificates, SSH keys, and other sensitive payloads.Read 14 Oct 2026 · oracle.com
Purpose: OCI Secret Management stores, retrieves, rotates, and manages passwords, API keys, tokens, and other secrets used by applications and cloud environments.Read 29 Sep 2026 · oracle.com
Intended users: The service is aimed at applications and cloud environments that need centrally managed secrets instead of credentials embedded in source code or configuration files.Read 29 Sep 2026 · oracle.com
Free plan: YesRead 22 Sep 2026 · oracle.com
Headquarters: Austin, Texas, USARead 28 Sep 2026 · oracle.com
Founded: 1977Read 28 Sep 2026 · oracle.com
Access control: OCI IAM policies provide granular access control for secrets.Read 29 Sep 2026 · oracle.com
Access methods: Administrators and applications can use the browser console, OCI CLI, REST management and retrieval APIs, or OCI SDKs.Read 14 Oct 2026 · docs.oracle.com
API endpoints: Secret creation uses a management endpoint, while cryptographic operations use a separate cryptographic endpoint; regional endpoints are documented.Read 14 Oct 2026 · docs.oracle.com
Auto-generation: Configurable templates can generate passwords, SSH keys, passphrases, and random bytes.Read 14 Oct 2026 · oracle.com
Auto-rotation: Scheduled rotation can run from one day to 360 days through the API and Terraform configuration, while Oracle’s product page highlights one-to-twelve-month intervals.Read 14 Oct 2026 · docs.oracle.com
Automatic rotation: Automatic secret rotation supports intervals from 1 to 12 months and integrates with Autonomous AI Database and OCI Functions.Read 29 Sep 2026 · docs.oracle.com
Availability design: The service maintains copies across fault domains and, where available, across two availability domains for durability and high availability.Read 14 Oct 2026 · docs.oracle.com
CLI support: The OCI CLI can create base64 secrets and configure automatic generation and rotation from JSON configuration files.Read 14 Oct 2026 · docs.oracle.com
Company facts: LinkedIn lists Oracle as a public IT services company founded in 1977, headquartered in Austin, Texas, with more than 10,001 employees.Read 14 Oct 2026 · linkedin.com
Cross-region replication: Secrets can be asynchronously replicated to as many as three target OCI regions.Read 14 Oct 2026 · oracle.com
Database and Functions integration: Automatic rotation supports Autonomous Database and OCI Functions, including custom rotation logic executed by Functions.Read 14 Oct 2026 · oracle.com
Default capacity limits: The documented tenancy defaults are 5,000 secrets, 30 active versions per secret, and 30 versions pending deletion per secret.Read 14 Oct 2026 · oracle.com
Default limits: A tenancy can have 5,000 secrets, with up to 30 active versions and 30 versions pending deletion per secret.Read 29 Sep 2026 · oracle.com
Deletion behavior: Deleting a secret starts a retention window between 24 hours and 30 days, after which permanent deletion cannot be reversed.Read 14 Oct 2026 · oracle.com
Encryption and auditing: Secrets are encrypted using keys in OCI Vault, and OCI manages encryption, decryption, access control, and audit logging.Read 29 Sep 2026 · oracle.com
Encryption protection: Secrets are encrypted with OCI Vault keys, which can use FIPS-validated HSM or software protection modes.Read 14 Oct 2026 · oracle.com
Expiry and reuse rules: Secret rules can set absolute or version expiry and block retrieval or reuse of expired or previously used values.Read 14 Oct 2026 · docs.oracle.com
Funding or ownership: Crunchbase lists Oracle as a public company with seven investors and a most recent funding event described as a January 30, 2025 post-IPO debt round.Read 14 Oct 2026 · crunchbase.com
Generated secret limits: Generated passphrases can be up to 32 characters, while generated RSA SSH key pairs can use 2048, 3072, or 4096-bit keys.Read 29 Sep 2026 · docs.oracle.com
Go SDK: Oracle publishes a Go secrets SDK with operations such as GetSecretBundle, GetSecretBundleByName, and ListSecretBundleVersions.Read 14 Oct 2026 · docs.oracle.com
IAM controls: OCI IAM policies can separately authorize reading, inspecting, using, rotating, and managing secrets by compartment, group, dynamic group, or resource type.Read 14 Oct 2026 · oracle.com
Kubernetes integration: Oracle documents an OKE pattern using workload identity and the Secrets Store CSI Driver to mount Vault secrets into Kubernetes workloads.Read 14 Oct 2026 · blogs.oracle.com
Limit: G2 ecosystem and MFA: G2 reviewers report that the product is most beneficial with Oracle-based software and one reviewer wanted authenticator-app or SMS two-factor support.Read 14 Oct 2026 · g2.com
Limit: Gartner support and coverage: Gartner reviews mention poorly prepared customer service and limited support for some platforms such as MongoDB, Snowflake, Databricks, and ClickHouse.Read 14 Oct 2026 · gartner.com
Limit: TrustRadius integration and cost: TrustRadius reviewers cite weaker third-party integration, difficult legacy migration, high cost for mid-sized companies, and occasional performance drops.Read 14 Oct 2026 · trustradius.com
Managed delivery: Oracle presents Secret Management as an OCI-hosted managed service accessed through its console, CLI, APIs, and SDKs rather than as a self-hosted package.Read 14 Oct 2026 · docs.oracle.com
Monitoring: Secret resources automatically expose oci_secrets metrics with dimensions including display name, resource OCID, response code, and target region.Read 14 Oct 2026 · docs.oracle.com
News: OKE secrets pattern: Oracle published an OKE Vault integration article on September 18, 2026 describing workload identity and Secrets Store CSI Driver usage.Read 14 Oct 2026 · blogs.oracle.com
News: replication launch: Oracle’s product page identifies May 2, 2024 as the announcement date for generally available cross-region secret replication.Read 14 Oct 2026 · oracle.com
Praise: G2 key management: G2 reviewers praise granular key administration, IAM integration, audit visibility, centralization, and ease of integration.Read 14 Oct 2026 · g2.com
Praise: Gartner security and value: Gartner reviewers praise strong isolation and security, integrated identity and observability, scalability, and predictable networking costs.Read 14 Oct 2026 · gartner.com
Praise: TrustRadius scalability and security: TrustRadius reviewers repeatedly praise scalable compute and storage, encryption and data masking, autonomous database operations, and regional availability.Read 14 Oct 2026 · trustradius.com
Rating on G2: 4.3 out of 5 from 36 reviewsRead 14 Oct 2026 · g2.com
Rating on Gartner Peer Insights: 4.2 out of 5 from 533 ratings for Oracle Cloud InfrastructureRead 14 Oct 2026 · gartner.com
Rating on TrustRadius: 8 out of 10 from 5 verified reviews published in the last 18 monthsRead 14 Oct 2026 · trustradius.com
Replication: Secrets can be replicated to up to three destination regions; replicas are read-only and inherit changes from the source secret.Read 29 Sep 2026 · docs.oracle.com
Secret types: Supported secret content includes database passwords, access tokens, third-party API keys, SSH private keys, application configuration secrets, and OAuth2 or JWT signing credentials.Read 29 Sep 2026 · oracle.com
Secret versioning: Every secret receives versions, allowing current, pending, historical, and rollback-oriented states.Read 14 Oct 2026 · docs.oracle.com
Terraform integration: The OCI Terraform provider exposes an oci_vault_secret resource with generation, rotation, expiry, metadata, and replication settings.Read 14 Oct 2026 · docs.oracle.com

Plans and prices

OCI Secret Management Free 5,000 secrets per tenancy · 30 active versions and 30 pending-deletion versions per secret · target-vault/key charges may apply for replication Read 14 Oct 2026 · oracle.com

Every Oracle Cloud Infrastructure Secret Management plan and price →

Strong points and limits

Strong points

Supports access through APIs, SDKs, CLI, and OCI Console.
Automatic rotation supports intervals from one to 12 months.
Replicates secrets to up to three destination regions.
OCI IAM policies provide granular access control.
Listed as free.

Limits

No price is provided.
Tenancy limit is 5,000 secrets.
Replicas are read-only.
Up to 30 active versions per secret.

Who it suits

OCI Secret Management is aimed at application and cloud environment operators who need centrally managed credentials. Its rotation, access controls, and read-only regional replicas may suit teams managing secrets across services and regions.

Verdict

OCI Secret Management centralizes a range of credentials with access controls, auditing, rotation, and regional replication. Its stated tenancy and version limits help define the scale it supports.