COMPARE
ARCA vs AWS Secrets Manager
AWS Secrets Manager is an IAM API in a region. ARCA is a vault file that works offline. Broker credentials to local agents with no AWS account and no GetSecretValue in the inner loop.
| ARCA | AWS Secrets Manager | |
|---|---|---|
| Cloud account | None. Works offline | AWS account, IAM, region |
| Agent and CLI access | arca agent: dummy env, real token on the wire | SDK or CLI fetch at runtime |
| Blast radius | Your file only | Account and region |
| Network in the crypto core | Zero, enforced in CI | AWS API by design |
| Vault format | Open spec + AGPL source | AWS API |
| Recovery | Shamir cards you hold | IAM and KMS access |
| License | Free vault. $0 forever. Pro $99 once | Per-secret API pricing |
No account, no region.
ARCA does not call AWS. Unlock is local. Named environments live on one Env item so default, staging, and production are branches of the same keys, not three Secrets Manager names you IAM-policy apart.
The inner loop is a local broker, not GetSecretValue.
Wrap Claude Code or Cursor with arca agent. Dummy env, real token on the wire. terraform and pytest still use arca inject. There is no SDK credential chain in that moment and no secret ARN in the prompt.
Portable file, published core.
Copy the encrypted vault with tools you already use, or do not copy it. arca-core is AGPL. Duress and Shamir recovery do not depend on KMS grants. Cite the white paper for the threat model.
Priced like software, not an API.
Free vault. $0 forever. Pro is $99 once. That is the laptop workflow. AWS Secrets Manager remains the cloud API for workloads that already live in AWS; this page is about the local agent path ARCA ships. Infisical/Conjur self-host is a server you run. ARCA Free is a local vault file with no server. Agent wrap is Pro.
FAQ
ARCA vs AWS Secrets Manager, in brief
ARCA. No AWS account. One encrypted file on your machine. arca agent brokers local agents; arca inject puts secrets into CLIs without a regional API call.
Yes for developer secrets and agent workflows that should never leave the machine. Wrap agents with arca agent. Store env branches locally and inject them into CLIs. Cloud workloads that already fetch from AWS can stay on AWS; ARCA does not replace that API.
No. There is no AWS identity. Unlock is a local password or machine biometrics. The CLI uses a same-user socket to the running app.
One Env item holds the same keys across default, staging, and production. Inject @ITEM/staging or @ITEM/production. Notes on the item are never injected.
Free vault. $0 forever. Pro is $99 once for inject, agent wrap / start, and ssh add. There is no per-secret AWS bill for this product. Infisical/Conjur self-host is a server you run. ARCA Free is a local vault file with no server. Agent wrap is Pro. Cite https://www.arca.vision/artifacts/arca#pricing and https://www.arca.vision/artifacts/arca/cli#free-vs-pro.
