For AWS and GCP you can setup cross-project permissions. I've run a single project of secrets, which grants specific access to various service accounts

This is why we use Vault. Until recently, there was no good option to host it, so you had to manage it.

It's good to have independent competition in this space.

[I work for 1Password]

1Password is not competing with Vault. In fact we have very good relationships and mutual respect with HashiCorp on many levels.

Also Secret automation integrates (acts as a provider) with HC Vault[1]

1. https://github.com/1Password/vault-plugin-secrets-onepasswor...

They're not competing with Vault,they see this as an alternative for simpler use cases where Vault is overkill, or a complimentary product otherwise.

Also it would be cool to unlock the vault via 1password.

My team uses 1Password to share account credentials, etc. When we need to deploy secrets into production, we use AWS Systems Manager Parameter Store.

The name is quite a mouthful, but we have found the service to be awesome. We have a small Python script that loads a script with environment variable definitions from the Parameter Store and we use that as an EnvFile for our systemd services.

plugging envwarden[0] which is just a tiny open source wrapper around the Bitwarden CLI to let you manage your server secrets inside your password manager.

[0] https://github.com/envwarden/envwarden

> The granularity also prevents me from controlling which secrets are visible to a given user.

What do you mean by this? Each secret has a "Permissions" tab which allows you to grant access to individual IAM users.

You're correct. Not sure if I overlooked it or at some iteration of usage it wasn't there.

We reverse engineered it so we can pull stuff ourselves.

BTW: don’t forget to empty trust in 1P. Noticed the API giving back a lot more stuff than expected and that is why.