AWS Secrets Manager Cost: 2026 Pricing Guide

July 17, 2026
Posted by Akeyless

Key Takeaways

AWS Secrets Manager costs $0.40 per secret each month plus $0.05 per 10,000 API calls, with no tiers, no seats, and no permanent free tier.
The headline price is cheap. The bill scales with the number of secrets times environments times regions, and every cross-region replica bills as its own secret.
API charges stay small until high-frequency retrieval, Lambda cold starts, or CI pipelines start hammering GetSecretValue.
Caching, grouping fields into a single JSON secret, and moving static config to Parameter Store are the highest-leverage ways to cut spend.
The cost most teams miss is the overhead of managing sprawl across AWS, other clouds, and on-prem, not the per-secret fee itself.

Quick Answer: What Is The AWS Secrets Manager Cost?

AWS Secrets Manager cost comes from two things: $0.40 per stored secret each month, prorated hourly, and $0.05 per 10,000 API calls, per the official AWS Secrets Manager pricing page. There are no upfront fees, tiers, or user seats, and no permanent free tier. Accounts created after July 15, 2025 instead receive up to $200 in general AWS credits.

Storage: $0.40 per secret each month, charged even for replicas and idle secrets.
API usage: $0.05 per 10,000 requests, roughly $0.000005 each, which climbs with retrieval frequency.
Rotation is included in the base price and only adds a negligible Lambda cost.

Quick Facts

Per-secret storage	$0.40 per secret each month, prorated hourly for partial months
API calls	$0.05 per 10,000 requests (about $0.000005 per call)
Free tier	No permanent tier; new accounts after Jul 15, 2025 get up to $200 in AWS credits (~500 secret-months)
Cross-region replicas	Each replica bills as a separate secret at $0.40 per month
Automatic rotation	Included in base price (RDS, Redshift, DocumentDB)
Regional pricing	Uniform across AWS commercial regions
Secret size	Up to 64 KB per secret (string, JSON, or binary)

How Much Does AWS Secrets Manager Cost?

On paper, AWS Secrets Manager pricing is about as simple as cloud billing gets. You pay forty cents per secret each month, plus a small charge for every batch of API calls. For a side project with a dozen credentials, the monthly cost rounds to the price of a coffee.

The math stops being friendly once you leave the side project behind. A production environment tends to carry dozens of secrets per service, duplicated across development, staging, and production, and sometimes replicated into a second region for failover. Multiply that by a growing set of microservices and the forty-cent line item turns into a four-figure annual bill nobody planned for. The question that matters is not what a single secret costs. It is what the whole estate costs once secrets multiply the way they always do.

Both charges appear on AWS’s own pricing page.

Storage costs $0.40 per secret each month, prorated by the hour if a secret exists for less than a full month. API usage costs $0.05 per 10,000 requests, which covers the calls your applications make to fetch and manage those secrets. You do not pay for seats, and there is no minimum spend or license tier to negotiate.

A secret here is a single stored object of up to 64 KB, holding a plaintext string, a JSON blob, or binary data. That detail matters more than it sounds, and it returns when we reach consolidation. Storage pricing is uniform across AWS commercial regions, which is unusual for AWS, and automatic rotation for supported engines like RDS, Redshift, and DocumentDB is bundled into the $0.40. Rotation creates a new version of the secret, but AWS does not charge for the new version, only for the Lambda invocations it triggers, and those cost a fraction of a cent.

One point catches teams off guard: there is no permanent free tier. AWS used to offer a 30-day trial per secret. Accounts created after July 15, 2025 instead receive up to $200 in general AWS credits that work across eligible services, enough to cover roughly 500 secret-months of testing. After the credits run out, every stored secret costs $0.40 a month for as long as it exists.

What Drives Your AWS Secrets Manager Bill?

There are two charges, and they behave nothing alike. Storage is steady and easy to forecast: count your active secrets and multiply by $0.40. The API charge is the volatile one, because it tracks how often your workloads read secrets rather than how many you keep.

Storage grows in a way that surprises people, because it compounds across environments. Few teams have fifty secrets. They have fifty in development, fifty in staging, and fifty in production, then they replicate the production set into a second region. Each cross-region replica bills as its own secret, so one secret copied into two additional regions costs $1.20 a month rather than $0.40. Spread that across a few hundred credentials and storage alone becomes a real number. This is ordinary secret sprawl at work: each secret looks trivial, so the total goes unnoticed until the invoice lands.

API charges climb when applications fetch secrets on a hot path. A Lambda function that calls GetSecretValue on every invocation without caching turns a million invocations into a million API calls, roughly $5 in retrieval fees before the function does any real work. Autoscaling fleets create bursts of reads at startup. Short cache lifetimes and retry loops push request volume higher without anyone noticing. None of this is expensive per call. It becomes expensive in aggregate, and it hides inside application behavior instead of on the pricing page.

Here is what the cost looks like across different scales, using the four worked examples AWS publishes on its own pricing page:

Scale	Setup (AWS’s example)	Monthly cost
Small production app	15 secrets, ~4,040 API calls/mo	~$6.02
Growing org (~$40K+ AWS spend)	1,500 secrets, ~900K API calls/mo	~$604.50
Enterprise (~$250K+ AWS spend)	10,000 secrets, ~12M API calls/mo	~$4,060
High-volume ephemeral microservices	5M hourly-valid secrets, 10M API calls/mo	~$2,850

AWS Secrets Manager cost scales with the number of secrets, environments, and regions, not with headcount or the value those secrets protect. It is cheap at fifteen secrets and starts to sting well before two thousand.

Why Do Secret Retrievals Cost More Than Teams Expect?

The same stored secret can have a very different operational footprint depending on how it gets used. A credential read once a day by a scheduled job stays close to the base forty cents. The same credential read thousands of times an hour by a containerized service, across a fleet that scales up and down, generates a request bill that dwarfs its storage cost.

Modern deployment patterns make this harder, not easier. Container orchestration and autoscaling multiply access, and short-lived jobs fetch fresh every time they run. A rolling deployment can set off a wave of cold starts that each pull a secret again. When an application reads from Secrets Manager on every request instead of caching the value, request volume, and therefore cost, climbs with traffic. What matters is not the storage price of a secret but how often something reads it.

AWS Secrets Manager Vs. Parameter Store: When Is Each Cheaper?

A large share of oversized Secrets Manager bills comes down to storing things that never needed to be there. AWS Systems Manager Parameter Store overlaps heavily, and its Standard tier is free for both storage and API calls, including encrypted SecureString parameters up to 4 KB. What it lacks is managed rotation and cross-region replication.

So the split is fairly clean. Use Secrets Manager for credentials that need automatic rotation, such as database passwords and rotating API keys. Use Parameter Store for configuration values, feature flags, and endpoint URLs that do not. A worked example shows the gap: an application with 5 database credentials in Secrets Manager and 50 configuration values in Parameter Store runs about $2 a month, against roughly $22 a month if all 55 sit in Secrets Manager. Same functionality, about 91% less cost.

Factor	AWS Secrets Manager	SSM Parameter Store (Standard)
Storage cost	$0.40 per secret each month	Free
API calls	$0.05 per 10,000 requests	Free (standard tier)
Automatic rotation	Built in (RDS, Redshift, DocumentDB)	Not built in
Cross-region replication	Yes (each replica billed)	No
Best for	Credentials that need rotation	Config, flags, static values

How Can You Reduce AWS Secrets Manager Costs?

None of these choices weaken security. Most simply remove waste, in rough order of impact:

Cache secrets in memory. The AWS Parameters and Secrets Lambda Extension or the SDK caching client lets workloads read once and reuse instead of fetching on every request, which routinely cuts API calls by 90% to 99%.
Group related fields into a single JSON secret. A database host, port, username, and password stored as four separate secrets cost $1.60 a month. Stored as one JSON object, they cost $0.40, a 75% reduction for that group.
Delete secrets you no longer use. A credential from a decommissioned service keeps costing $0.40 a month indefinitely, so a quarterly audit clears out anything nobody references.
Move non-rotating values to Parameter Store, where the Standard tier is free.
Use resource policies instead of replicas when you only need cross-account access inside one region, which avoids the per-replica charge.

Worth keeping in mind: the cheapest secret is the one you never have to store, and the safest is often the one your workload never has to hold. Caching and consolidation trim the invoice. Taking long-lived secrets out of the workflow trims the risk that drives most identity breaches.

The AWS Secrets Manager Cost The Pricing Page Doesn’t Show

All of that comes with a published number. The cost that moves enterprise budgets the most does not. It is the overhead of managing secrets once they spread beyond a single system.

AWS environments rarely stay purely AWS. Secrets end up in Azure and GCP, in Kubernetes clusters, in CI/CD pipelines, in SaaS tools, and in on-prem systems. Each new store means another policy model to maintain, another audit trail to reconcile, and a rotation schedule that somebody has to own. Research from GitGuardian and CyberArk puts the average enterprise at roughly six separate secrets-manager instances running side by side. That fragmentation is where the real cost lives: engineering hours, longer audit cycles, and the exposure of credentials nobody is actively watching.

The exposure is not hypothetical. CyberArk’s 2025 State of Machine Identity Security Report found that half of organizations reported a security incident tied to compromised machine identities, and Gartner’s 2024 IAM Leadership Survey found 54% saw a rise in identity-related breaches. Long-lived, scattered secrets are a common thread. Once the cost of an outage or a breach enters the picture, forty cents per secret stops being the figure that matters.

How Akeyless Approaches Secrets Cost At Enterprise Scale

The Challenge

A platform team can tune AWS Secrets Manager down to the last cent and still carry the larger cost: several vaults spread across several clouds, each with its own governance, rotation, and audit. Optimizing one vault does nothing for a fragmented estate.

The Approach

Akeyless is a cloud-native SaaS platform that brings secrets, certificate lifecycle, key management, and privileged access under one control plane. Rather than asking teams to migrate off AWS Secrets Manager, its Multi-Vault Governance, delivered through the Universal Secrets Connector, governs secrets already living in AWS, Azure, GCP, HashiCorp Vault, and Kubernetes from one interface, applying consistent rotation and audit without moving anything. Where workloads can modernize, Akeyless issues dynamic, short-lived credentials and secretless authentication, so machines, workloads, and AI agents receive access just in time instead of holding a static secret that has to be stored, rotated, and paid for.

The Outcome

Consolidation is what bends the cost curve. One platform replaces the licensing and upkeep of several separate tools for secrets, PAM, certificate lifecycle, and key management, and short-lived access shrinks the pool of long-lived secrets that drive storage charges and rotation work. What teams see afterward is fewer idle secrets, consistent audit across environments, and lower total cost of ownership than stitching point tools together. The Akeyless vs. AWS Secrets Manager comparison lays out the head-to-head in detail.

What This Looks Like For Real Teams

Two Akeyless customers put numbers to it.

Cimpress, the parent company behind Vistaprint and more than a dozen subsidiaries, consolidated credential rotation and adopted temporary database credentials, cutting total cost of ownership by 70% while platform adoption grew 270%.

“We set Akeyless up 9 months ago and we haven’t had to worry about credential rotation. We haven’t had to worry about credential leakage. All of our software that’s running, it just works – we haven’t really had to think about it since then. It’s been a really smooth, really easy process.”

– Conor Mancone, Principal Application Security Engineer, Cimpress

Progress, which manages secrets across AWS, Azure, and GCP after years of acquisitions, reduced the maintenance and provisioning overhead of secrets management by 60% to 70% after moving to a purpose-built SaaS control plane.

“Akeyless is true SaaS that allows you to scale. It’s purpose-built to live in the cloud. We saved 70% of our maintenance and provisioning time with Akeyless.”

– Richard Barretto, Chief Information Security Officer & VP, Progress

The Bottom Line On AWS Secrets Manager Cost

AWS Secrets Manager is a solid, well-integrated choice for AWS-native workloads, and its pricing stays cheap until scale catches up. A few habits keep the bill in check. Remember that it grows with secrets, environments, and regions. Cache and consolidate before you reach for anything else. And do not park things in Secrets Manager that Parameter Store will hold for free. Then ask the bigger question: whether the number you are paying down is the per-secret fee, or the cost of running secrets management in several places at once.

FAQs About AWS Secrets Manager Cost

How Much Does AWS Secrets Manager Cost Per Secret?

$0.40 per secret each month for storage, prorated hourly for partial months, plus $0.05 per 10,000 API calls for retrieval and management operations. There are no tiers or seats.

Is There A Free Tier For AWS Secrets Manager?

Not a permanent one. AWS previously offered a 30-day trial per secret. Accounts created after July 15, 2025 instead receive up to $200 in general AWS credits, covering roughly 500 secret-months. After that, every stored secret costs $0.40 a month.

Why Is My AWS Secrets Manager Bill Higher Than Expected?

Almost always secret count and API volume. Secrets multiply across environments and regions, and each cross-region replica bills as a separate secret, while high-frequency GetSecretValue calls, especially from uncached Lambda functions, drive up request charges.

Is AWS Secrets Manager Cheaper Than Parameter Store?

For values that need managed rotation, Secrets Manager earns its cost. For configuration and static values, Parameter Store’s Standard tier is free and usually the cheaper choice. Many teams use both, keeping rotating credentials in Secrets Manager and everything else in Parameter Store.

Does Rotation Add To The AWS Secrets Manager Cost?

No. Automatic rotation is included in the $0.40 per-secret price. It triggers Lambda executions that cost a negligible fraction of a cent per rotation.

How Do I Reduce AWS Secrets Manager Costs?

Cache secrets in memory to cut API calls, group related fields into a single JSON secret, delete unused secrets, move non-rotating config to Parameter Store, and use resource policies instead of cross-region replicas when you only need cross-account access. Beyond that, consolidating secrets governance across clouds addresses the overhead the per-secret fee hides.