how to find who added user in Password safe

You can run a report for that.

Reports-->Password Safe-->Activity

For Operations, select Add, Object Type, Managed Account and select your date range. I used last month to today just out of laziness.

The target is the account and the user ID/Full Name is the account that did it. In this example, you see this was done via our API.

and this is me onboarding a secret from AWS Secrets Manager

This is an on premises solution, I’ve never used the cloud SaaS solution so your results may vary. For our on premises deployment, access is controlled via group management in Active Directory and we use provisioning software to add and remove users from the group so that tracks when and who added or removed users from BT.