Debatable. From my experience, all major clours have alternatives to Vault, but not "better" by any stretch of the imagination.

The app instance authenticates using the cloud providers key vault and from here it’s allowed to use a policy claiming tokens granting rights to a specific db role. These tokens are short lived and are automatically renewed.

This is just one case - vault have a lot of useful integrations that let you “float above” any cloud:

https://www.vaultproject.io/docs/secrets

I like to keep my concerns separated. That way we can use any cloud as IaaS and keep the platforming part ourselves. Vault is at the heart of achieving something like this.

Keeping services discoverable, with service health-checks and configuration data at hand in the k/v is not needed in the “cloud”? I guess a lot comes down to how you opt to manage you services… It’s what etc does, but worse (imo), for k8s. My usual work with larger infrastructure spans more than k8s or a single provider, hence consul is a given.

To my knowledge no other secrets solution exists that cover all the things vault does, and at the same lets you stay provider agnostic. It integrates well with the major cloud providers though!

A thing I like about Consul is that you can also use it as a KV. Something I lack in the cloud.

The Vault in Azure is the Keyvault which is all around terrible but Keyvault in conjunction with how Azure works in general is sufficient to build secure infrastructure.

Its bloody too complex was a good enough reason to move off it to ECS.

That's an interesting take! How do you route requests to the right VM/instance whilst VMs go up/down?

Also keeping discovery and configuration separate from the cloud provider makes a hybrid approach feasible - which I believe is relevant.

Big cloud pricing is big, depending on circumstances.