teller

Teller unifies them behind one CLI and one config file. It's a secrets multiplexer.

Map your environment variables to any combination of secret stores, and Teller fetches them at runtime. `teller run, node app.js` injects secrets into your process without them ever touching disk. It also syncs between providers: pull from Vault, push to AWS, or vice versa.

Apache 2.0, written in Rust. No paid tier, no cloud version.

The catch: Teller solves a real problem but it's a niche one. If you only use one secrets manager, you don't need it. Just use that provider's SDK. The value shows up when you have secrets scattered across 3+ providers and need one workflow. The community is small and the tool is emerging. Don't bet critical infrastructure on it without evaluating the bus factor. For a more established approach, look at how Infisical or HashiCorp Vault handle multi-source aggregation.