AWS Secrets Manager Pricing Calculator & Complete Cost Guide
Interactive AWS Secrets Manager pricing calculator. Compare costs vs Parameter Store and understand optimization strategies for secret storage and API calls.
Pricing TLDR
- • $0.40 per secret per month (prorated by hour)
- • $0.05 per 10,000 API calls
- • $200 free tier credits for new AWS customers (starting July 15, 2025)
- • Secrets marked for deletion are not charged
Official pricing:
AWSAWS Secrets Manager Pricing Calculator
Quick Examples:
Number of secrets
0
100
Each secret costs $0.40/month regardless of size
API calls per month
0
1M
GetSecretValue, PutSecretValue, and other API operations
Enable client-side caching
Multi-region replication
Each replica counts as a separate secret ($0.40/month each)
KMS encryption key
Automatic rotation
Lambda rotation cost: ~$0.000002 per rotation (negligible)
Estimated Monthly Cost
$4.25
Secret Storage
$4.00
API Calls
$0.25
Lambda Rotation
$0.00
💳 New AWS customers get $200 in credits (6 months)
About AWS Secrets Manager
What is AWS Secrets Manager?
AWS Secrets Manager is a fully managed service that helps you protect access to your applications, services, and IT resources. It enables you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle.
- Automatic Secret Rotation: Native integration with RDS, Redshift, and DocumentDB for automatic password rotation without application downtime
- Centralized Secret Management: Store and manage credentials, API keys, and other secrets with fine-grained access control using IAM policies
- Encryption & Compliance: Secrets encrypted at rest using AWS KMS and in transit using TLS, with audit trail via CloudTrail for compliance
- Cross-Region Replication: Replicate secrets across multiple regions for disaster recovery and low-latency access
When to Use AWS Secrets Manager
AWS Secrets Manager is worth the $0.40/secret cost when you need automatic rotation, RDS integration, or cross-region replication. For static secrets that don't rotate, consider the free AWS Systems Manager Parameter Store instead.
Ideal for
- Database credentials requiring automatic rotation (RDS, Redshift, DocumentDB)
- Secrets needing cross-region disaster recovery with replication
- Applications requiring audit trails for compliance (HIPAA, PCI-DSS, SOC 2)
- Multi-account organizations with centralized secret management
- Production workloads where automation justifies the $0.40/month cost
Not ideal for
- Static API keys that never change (use Parameter Store - free)
- Configuration values and environment variables (use Parameter Store)
- Cost-sensitive applications where $0.40/secret is significant
- Secrets under 8KB that don't need rotation (Parameter Store is sufficient)
- Development/test environments with minimal secret rotation needs
AWS Secrets Manager Pricing Breakdown
AWS Free Tier Credits
Starting July 15, 2025, new AWS customers receive up to $200 in AWS Free Tier credits that can be applied to Secrets Manager and other eligible AWS services. This replaces the traditional service-specific free tiers with a flexible credit-based system.
- $200 in credits for new AWS customers (accounts created after July 15, 2025)
- Free plan: Credits available for 6 months after account creation
- Paid plan upgrade: Remaining credits auto-apply, must use within 12 months of account creation
- At $0.40/secret/month, $200 covers approximately 500 secret-months of usage
- Credits apply to both secret storage ($0.40/secret) and API calls ($0.05/10K)
- Legacy accounts (pre-July 15, 2025): No free tier for Secrets Manager
Secret Storage Pricing
Storage pricing is straightforward at $0.40 per secret per month, prorated hourly. This pricing is globally uniform across all 36 AWS regions - a unique characteristic among AWS services.
Secret Storage
$0.40/month
Per secret, prorated hourly
- Globally uniform pricing (all 36 regions)
- Unlimited secret versions at no extra cost
- Each replica in multi-region counts separately
- Deleted secrets NOT charged during recovery window (7-30 days)
- Secrets up to 64KB supported (10KB recommended)
- No volume discounts available
API Request Pricing
API requests are charged at $0.05 per 10,000 requests ($0.000005 per request). This applies to all API operations including GetSecretValue, PutSecretValue, and even metadata queries.
All Operations Count
GetSecretValue (most common), PutSecretValue (rotation), DescribeSecret (metadata), ListSecrets, CreateSecret, DeleteSecret, and UpdateSecret all count toward API costs.
Caching Reduces Costs by 90%+
Implement client-side caching to dramatically reduce API costs. Example: 1M Lambda invocations without caching = $5/month, with 5-minute caching = $0.01/month (99.8% reduction).
Rotation Triggers Multiple Calls
Automatic rotation operations generate several API calls per rotation. This is typically negligible compared to application retrieval costs.
No Free Tier for API Calls
Unlike some AWS services, there is no free tier for API requests. Every call is charged at $0.000005, even during application development.
Related Service Costs
AWS Secrets Manager relies on other AWS services that may add to your total cost:
- AWS KMS (Encryption Keys): AWS-managed key: FREE (default). Customer-managed key: $1.00/month per key + $0.03 per 10,000 KMS API calls (usually negligible). Use default unless compliance requires CMK.
- AWS Lambda (Rotation Functions): Typical cost: ~$0.000002 per rotation (negligible). Monthly impact: <$0.01 for most rotation schedules. Even daily rotations of 100 secrets cost only ~$0.006/month.
- CloudWatch Logs (Rotation Logging): Ingestion: $0.50/GB, Storage: $0.03/GB/month. Typical impact: <$0.10/month for rotation logs.
- EventBridge (Rotation Scheduling): FREE within first 1 million events/month. Rotation scheduling typically uses <100 events/month, so effectively free.
Regional Pricing Uniformity
AWS Secrets Manager has identical pricing across all 36 AWS regions - a rare exception among AWS services. This simplifies budgeting and allows region selection based on latency and compliance rather than cost.
Global Uniform Pricing
All regions (US, Europe, Asia Pacific, GovCloud, etc.) charge $0.40/secret and $0.05/10K API calls. No regional variations whatsoever.
Region Selection Strategy
Choose regions based on latency to applications, data residency requirements, and compliance needs - not cost. Virginia costs the same as Singapore.
Multi-Region Replication Costs
Each replica counts as a separate secret. 1 secret in 3 regions = $1.20/month (3 × $0.40). Only replicate critical secrets for disaster recovery.
Simplified Budgeting
No need to account for regional variations. Calculate cost once, apply globally across all deployments.
Real-World AWS Secrets Manager Pricing Examples
Small Startup
$2.03/month
• 10 secrets × $0.40
• 5,000 cached API calls
• Monthly rotation
• Single region
10 database credentials with Lambda caching
Mid-size Company
$45.00/month
• 100 secrets × $0.40
• 1M API calls (no caching)
• Weekly rotation
• 2 regions for DR
100 secrets with moderate API traffic
Large Enterprise
$670.05/month
• 500 secrets × 3 regions
• 10M API calls (cached)
• 20 custom KMS keys
• Daily rotation
500 secrets replicated across 3 regions with caching
AWS Secrets Manager vs Parameter Store
Both services store secrets, but with different capabilities and pricing models. Choose based on your rotation and integration needs.
Secrets Manager
$0.40/secret + $0.05/10K API calls
Parameter Store (Standard)
FREE
Parameter Store (Advanced)
$0.05/parameter
Secrets Manager
$0.05 per 10K
Parameter Store (Standard)
FREE
Parameter Store (Advanced)
FREE
Secrets Manager
✅ Native RDS/Redshift
Parameter Store (Standard)
❌ Manual only
Parameter Store (Advanced)
❌ Manual only
Secrets Manager
✅ Yes
Parameter Store (Standard)
❌ No
Parameter Store (Advanced)
✅ Yes
Secrets Manager
64KB (10KB recommended)
Parameter Store (Standard)
4KB
Parameter Store (Advanced)
8KB
Secrets Manager
Unlimited
Parameter Store (Standard)
100 versions
Parameter Store (Advanced)
100 versions
Secrets Manager
Rotating credentials, RDS
Parameter Store (Standard)
Static secrets, config
Parameter Store (Advanced)
Advanced features needed
💡 Use Parameter Store for static secrets to save $0.40/month per secret (100% savings on storage)
11 AWS Secrets Manager Cost Optimization Tips
Implement client-side caching for 90%+ API cost reduction
Cache secrets in Lambda function memory or application runtime for 5-15 minutes. This reduces 1M API calls ($5/month) to ~10K calls ($0.05/month), saving $4.95/month per high-traffic application.
Use Parameter Store for static secrets (100% storage savings)
Move API keys, configuration values, and other non-rotating secrets to Parameter Store Standard (free). Reserve Secrets Manager for database credentials and other rotating secrets. Saves $0.40/month per static secret.
Consolidate related credentials into single secrets
Store multiple related credentials in one secret as JSON (up to 64KB). Example: 10 API keys as separate secrets = $4/month, consolidated into 1 secret = $0.40/month (90% savings).
Optimize multi-region replication (stop unnecessary replicas)
Audit which secrets truly need cross-region replication. Each replica multiplies storage costs. Example: 20 secrets in 3 regions = $24/month, reduce to 5 critical secrets replicated = $6/month (75% savings).
Use default AWS-managed KMS key (save $1/month per key)
Unless required by compliance, use the free AWS-managed encryption key instead of customer-managed keys. Provides same encryption strength without the $1/month CMK cost.
Use force delete for non-critical secrets (skip recovery window)
Force delete dev/test secrets immediately without recovery window using ForceDeleteWithoutRecovery parameter. Deleted secrets with recovery windows are free, but force delete allows immediate secret name reuse and cleaner secret inventory.
Optimize rotation frequency based on actual risk
Rotate high-risk production database credentials every 30 days, medium-risk service accounts every 90 days, and low-risk dev credentials every 180 days or manually. Reduces Lambda execution costs and operational noise.
Batch secret retrievals during application initialization
Retrieve all needed secrets at app startup and cache in memory for the application lifetime. Avoids per-request fetches that multiply costs. Can reduce API calls from 30K/month to <100/month.
Leverage AWS Free Tier credits for new projects
New AWS customers (post-July 15, 2025) receive $200 in credits valid for 6 months (free plan) covering ~500 secret-months at $0.40/secret. Use this period to thoroughly test rotation automation, caching strategies, and overall cost-effectiveness before committing to paid usage. Credits apply to both storage and API calls.
Audit and remove unused secrets promptly
Active secrets cost $0.40/month until marked for deletion. Mark unused secrets for deletion immediately to stop charges (no cost during 7-30 day recovery window). Audit monthly to catch forgotten secrets in abandoned projects and avoid unnecessary costs.
Monitor Secrets Manager Spending in Real-Time
Track AWS Secrets Manager costs per secret and API call patterns with CostGoat. Get instant alerts when API costs spike from poor caching, when active secrets exceed budget thresholds, or when multi-region replicas multiply storage costs unexpectedly.
Monitor Your AWS Costs in Real-Time
CostGoat is a privacy-first desktop app that tracks your actual AWS spending as you use it. Get instant visibility into your usage and never get surprised by your cloud bills again. 7-day free trial, then $9/month.
Start Free TrialAWS Secrets Manager Pricing FAQ
Common questions about AWS Secrets Manager costs and pricing model
