AWS Secrets Manager Pricing Explained (With Real Cost Examples)

AWS Secrets Manager has one of the simpler pricing models in the category, and it catches people out anyway. Two components:

• $0.40 per secret per month, prorated by the hour
• $0.05 per 10,000 API calls

There is a 30-day free trial. There is no free tier after it. Prices are for the main US and EU regions and vary elsewhere; check the AWS pricing page for yours, since this was accurate in September 2026 and AWS changes prices.

The important detail people miss: each secret version does not cost extra, but each distinct secret does. Storing your database URL, Stripe key and JWT secret as three secrets is $1.20 a month. Storing them as one JSON blob is $0.40. That decision is worth making deliberately.

Worked examples

Solo developer, one app, five secrets 5 × $0.40 = $2.00/month. API calls negligible. About $2/month.

Small team, three environments, ten secrets each 30 secrets × $0.40 = $12.00/month. Say 100,000 API calls = $0.50. About $12.50/month.

That is the number worth sitting with. Thirty secrets is not a lot — ten values across dev, staging and production — and it is already comparable to a flat-priced hosted tool while giving you no team workflow, no local development story and no UI beyond the AWS console.

Larger team, 100 secrets, high call volume 100 × $0.40 = $40.00. 5,000,000 calls = $25.00. About $65/month.

At this scale it is still cheap relative to per-seat tools, and the API call component starts to matter.

The costs people miss

API calls from every task start. If your application calls GetSecretValue on boot and you run containers that restart frequently, or Lambda functions with cold starts, the call count climbs faster than expected. Cache the value in memory for the lifetime of the process rather than fetching per request.

Rotation costs calls. Automatic rotation invokes a Lambda, which makes API calls. Small, but it exists.

Replication is per region. A secret replicated to three regions is billed as three secrets, $1.20 a month.

Deleted secrets keep billing during the recovery window. Deletion is a scheduled operation with a default 7 to 30 day recovery period, and you are charged while it waits. Use --force-delete-without-recovery if you genuinely want it gone, and be sure, because there is no undo.

KMS costs if you use a customer-managed key. The default AWS-managed key is free. A CMK is $1/month plus request charges.

Versus Parameter Store

AWS has a second service that stores configuration, and the pricing difference is the reason people ask.

Systems Manager Parameter Store standard parameters are free. Up to 10,000 parameters, 4KB each, no monthly charge, and standard-throughput API calls are free too. Advanced parameters cost $0.05 per parameter per month with an 8KB limit.

So why pay for Secrets Manager?

The honest summary: if you do not need automatic rotation, Parameter Store with SecureString parameters does most of what a small team needs for free. A great many teams pay for Secrets Manager without using the feature that justifies it.

Rotation is genuinely valuable for RDS credentials, where AWS provides ready-made rotation Lambdas. For a Stripe API key that you rotate by hand twice a year, you are paying $0.40 a month for a feature you never invoke.

Where it fits, and where it does not

Good fit: your application runs on AWS, secrets are consumed by AWS services at run time, you want IAM-native access control, and you want automatic rotation for RDS or DocumentDB credentials.

Poor fit: you want a team workflow for local development. Secrets Manager has no CLI story for syncing a developer's .env, no per-environment UI designed for humans, no change approvals and no concept of a team member. It is infrastructure for machines reading secrets, and it is very good at that.

That is the actual dividing line, more than price. If your question is "how do my four developers all get the right environment variables on their laptops," that is the secrets management problem in its team-workflow form, and Secrets Manager is not built for it, and the free tier of a dedicated tool will serve you better than $12 a month of AWS. The comparison post covers the options, including Krypt, which we build and which is flat-priced for the whole team.

Plenty of teams run both: a developer-facing tool for local and CI, and Secrets Manager for what production services read at run time. They solve different halves of the problem.

Reducing the bill

• Group related values into one secret as JSON. One secret, one charge, parse it in your application.
• Use Parameter Store for anything that does not need rotation. Free for standard parameters.
• Cache in memory. Fetch on process start, not per request.
• Delete unused secrets with force. Avoid paying through the recovery window.
• Do not replicate to regions you do not serve.

FAQ

How much does AWS Secrets Manager cost? $0.40 per secret per month plus $0.05 per 10,000 API calls, in the main US and EU regions. No free tier after the 30-day trial.

Is there a free tier? A 30-day free trial only. Parameter Store standard parameters are free permanently and are the usual free alternative.

Do secret versions cost extra? No. Multiple versions of the same secret count as one secret. Multiple distinct secrets each cost $0.40.

Is Parameter Store cheaper than Secrets Manager? Yes, standard parameters are free. The trade-off is no automatic rotation, no cross-region replication and a 4KB value limit.

Am I charged for a deleted secret? Yes, during the recovery window, which is 7 to 30 days by default. Force delete to stop charges immediately.

Can I use it for local development? Technically, via the AWS CLI, but it is not designed for it. There is no built-in way to sync secrets into a developer's .env file the way dedicated tools provide.