[spydum]

Vault already did secrets. Nothing stops you from writing an azure function to handle rotation, but you gotta build it yourself. AWS has BUILT IN support for RDS.

However, the biggest delta is: I'm like 90% sure Azure key vault doesn't have fine-grained access policy per VAULT. That kind of stinks.. you need a vault per role ideally.