KMS? Secrets manager? Are those offered by a particular vendor or what

Yeah, they’re AWS secrets management services.

Yes, these two are AWS terms, but other clouds have nearly the same services, and often called the same, too.

Yes but if you want to be multi-cloud and not have to integrate with each cloud's secret storage API, you would do it once for Vault and bring it with you to each cloud.

Probably I just work at more dysfunctional places than you, but:

If I'm building product for on prem I'd prefer to use env vars or k8s secrets and let the customer integrate their preferred secrets manager. Also helpful when you run sales POCs where ease of getting to splash page really matters.

Building inside enterprise, I've never actually had to support multiple clouds for the same component but if it ever comes up and I have any sort of choice in the matter I would probably rather template 3 native secrets integrations than deal with the special circle of hell that is enterprise-managed Vault or CyberArk.

The reality is you will never use a common secret storage anyway as usually and even when using multi-cloud tools like terraform you write a lot of cloud vendor specific stuff because they do not share the same provider. So using different secret storage API is not a huge deal and pretty much a moot point.

Also my vision of multi-cloud in large org hasn't been that a particular product/app or team was ever using multiple clouds. My experience is that large orgs like to have multi-cloud support because they grow by acquiring other companies regardless of which cloud vendor they are using so you just want to provide standards and templates for everyone. Obviously said templates will be usually cloud vendor specifics.

Even when going multi-cloud you can employ different strategies. Vault is definitely one of them, but you can also use federation to exchange one cloud's credentials for another's, giving you the ability to centralize secrets in one of them. You can use a layer of abstraction like GoCloud [0]. You can also build for each cloud separately and decide either not to centralize secrets at all, or build some trivial bespoke tooling to synchronize some of them. I'm not endorsing any of the options, nor am I trying to argue that Vault is never the right choice, I'm just pointing out that Vault isn't the only viable alternative.

https://github.com/google/go-cloud