The rate card says $0.40 per secret. You have 10 secrets. The bill says $27.20.
AWS Secrets Manager pricing is simple; the count behind it isn't. It grows with every environment, replica Region, password RDS stores for you, and secret nobody deleted. Uncached reads add a second line.
AWS Secrets Manager pricing has two charges in us-east-1: $0.40 per secret per month and $0.05 per 10,000 API calls. There's no free-tier line in the price list, but accounts created on or after July 15, 2025 can spend up to $200 in Free Tier credits on it.
Below: the multiplication, cached reads, charges billed elsewhere, when Parameter Store fits, and what to delete. Prices are from the AWS Price List API, September 2026.
What AWS Secrets Manager pricing actually charges for
In us-east-1 a secret costs $0.40 per month and an API call $0.000005 ($0.05 per 10,000), with no tiers, minimums or setup fees. Partial months prorate hourly, $0.00056 per secret-hour in AWS's example. A secret stored for a month is a secret-month, the unit the bill counts.
| Item | us-east-1 price | What moves it |
|---|---|---|
| Secret | $0.40 per month, prorated hourly | Secrets × environments × Regions |
| Replica secret | $0.40 per month each | ReplicaRegions entries |
| API calls | $0.05 per 10,000 | Reads per invocation, cache TTL |
| New versions | Free | Rotation creates them |
| Secret scheduled for deletion | Free | 7-to-30-day recovery window |
aws/secretsmanager key | Free to own | See the KMS line below |
The AWS Secrets Manager pricing page lists no volume discount, and storage usually dominates: AWS's Example 3 prices 1,500 secrets at $600.00 a month against 900,000 calls at $4.50, a ratio the AWS Secrets Manager Pricing Calculator reproduces for your counts.
What counts as one secret
A secret is a value plus metadata. AWS recommends storing related values as one JSON document of key/value pairs, up to 65,536 bytes, so a database credential with host, port, username, password, dbname and engine is one billed secret, not six.
The catch: access is controlled per secret, so bundling values owned by different teams widens who reads what. I bundle values that share a consumer.
Is AWS Secrets Manager free? Free Tier credits vs the 30-day trial
Not permanently. The price list has no free-tier item; the current pricing page offers only AWS Free Tier credits for newer accounts.
| Account created | Current pricing page | What to do |
|---|---|---|
| On or after July 15, 2025 | Up to $200 in credits; free plan for 6 months; credits used within 12 months | Model the $0.40 rate anyway |
| Before July 15, 2025 | Not stated; no 30-day trial listed | Check your bill before counting on a trial |
What stays free: versions, secrets pending deletion, owning aws/secretsmanager, and Parameter Store standard parameters at standard throughput (KMS requests aside) for values that don't need Secrets Manager features.
Why your bill is higher than $0.40 times the secrets you remember
Take a team with 10 secrets, $4.00 a month in us-east-1, and count the way the bill does. The counts are illustrative; the multipliers are real.
| Source | Secrets | Monthly (us-east-1) | How to catch it |
|---|---|---|---|
| Headline count | 10 | $4.00 | Your inventory |
| × 3 environments | 30 | $12.00 | Per account and Region |
| + prod replicas (10 × 2 Regions) | 20 | $8.00 | ReplicaRegions |
| + RDS-managed master passwords | 3 | $1.20 | RDS and Aurora settings |
| + forgotten secrets | 15 | $6.00 | LastAccessedDate |
| Billed | 68 | $27.20 | 6.8× the headline |
The environment row replaces the headline; the rest add to it. That's $326.40 a year, before any API call.
Enter replicas and service-created secrets as stored secrets in the Secrets Manager calculator.
Every replica is a second secret
Each replica bills as a distinct secret at $0.40 a month in us-east-1, so a secret in three Regions is three secret-months. Rotation propagates from the primary, and each Region can use aws/secretsmanager or its own key.
The alternative is calling the endpoint in the secret's home Region. I'd replicate only when a workload elsewhere must read the secret on its own. Replication data transfer isn't priced on AWS's pages.
Secrets AWS services create for you
When RDS or Aurora manages a master user password in Secrets Manager, you are charged for that secret. RDS rotates it every seven days by default and deletes it with the instance or cluster.
Short-lived secrets bill by the hour
AWS's Example 2 stores 5,000,000 one-hour tokens at $0.00056 each, $2,800, plus $50 for 10,000,000 calls. A secret per request or session produces that bill.
How API calls add up, and what caching saves
Each call is $0.000005 in us-east-1, and AWS lists no free operations, so budget every call, including DescribeSecret calls from caching libraries. AWS's own answer to that cost is a cache. AWS's caching guidance lists more options; these three state a default TTL (time to live):
- Java and .NET caching libraries: 1 hour.
- AWS Parameters and Secrets Lambda Extension: 300 seconds, holding up to 1,000 secrets.
- AWS Workload Credentials Provider, formerly the Secrets Manager Agent: 300 seconds, adjustable from 0 to 3,600, on Lambda, ECS, EKS and EC2.
Caches don't invalidate on rotation; secret-update events in Amazon EventBridge can trigger a refresh. BatchGetSecretValue returns up to 20 secrets per call, though whether billing counts the call or each secret is undocumented.
A Lambda function reading one secret, with and without a cache
A frequently invoked Lambda function reads an API key on each of 10,000,000 monthly invocations: $50.00 a month in us-east-1, or $150.00 across three secrets. Cached, calls ≤ cache copies × (seconds in month ÷ TTL). The table assumes 20 copies warm all 30 days, an input you replace; each cold start adds a fetch.
| Read pattern | Calls/month | Secrets Manager | KMS, customer managed key | Use it for |
|---|---|---|---|---|
| 3 secrets, uncached | 30,000,000 | $150.00 | $90.94 | Nothing; bundle them |
| 1 JSON secret, uncached | 10,000,000 | $50.00 | $30.94 | Rarely invoked code |
| 300-second cache | ≤ 172,800 | ≤ $0.864 | ≤ $1.46 | Lambda extension default |
| 1-hour cache | ≤ 14,400 | ≤ $0.072 | $1.00 | Values that change rarely |
The 300-second cache cuts calls by at least 98%. Put your post-cache call count, not your invocation count, into the calculator.
The KMS line that follows every read
With a customer managed key, one you create, each GetSecretValue triggers a KMS Decrypt. In us-east-1 the key is $1 a month, up to $3 once rotated twice, and requests $0.03 per 10,000 after 20,000 free, shared across all Regions and KMS use in the account. Customer managed KMS key pricing covers both rates.
aws/secretsmanager has no key charge, and Secrets Manager describes it as free to use. The KMS pricing page adds that requests to AWS managed keys are charged. At high read volume, check the KMS line instead of assuming zero.
What secret rotation costs: Lambda rotation vs managed rotation
Rotation isn't inside the $0.40. What matters is whether a Lambda function in your account does the work.
| Rotation type | Lambda in your account? | What you pay | Applies to |
|---|---|---|---|
| Rotation by Lambda | Yes | Function at Lambda rates, plus calls | Secrets without managed rotation |
| Managed rotation | No | No separate price published | RDS, Aurora, DocumentDB, Redshift, ECS Service Connect |
| Managed external secrets | No | No separate price published | 16 SaaS secret types, including Salesforce and GitLab |
The rotation function bills at Lambda rates, per Secrets Manager's billing notes. It runs once per step (create_secret, set_secret, test_secret, finish_secret), and a failed step retries the whole rotation several times.
Managed rotation, and managed external secrets (launched November 19, 2025), run no Lambda in your account. No separate price is published, so budget the standard charges and confirm on your first bill.
The API side is small: AWS's Example 1 budgets 7 calls per database credential per week, $0.0007 for 5 credentials over 4 weeks in us-east-1. Four-hour rotation adds no fee beyond extra calls and Lambda invocations.
Charges that land on other lines: KMS keys, VPC endpoints, CloudTrail
These bill under other services, outside the calculator, but Secrets Manager choices set them.
| Charge | When it applies | us-east-1 rate | How to size it |
|---|---|---|---|
| Customer managed KMS key | Custom policy, cross-account, replica keys | $1 per key-month ($3 rotated), $0.03 per 10,000 past 20,000 free | Default to aws/secretsmanager |
| Interface VPC endpoint | Private-subnet reads | $0.01 per hour per AZ, $0.01 per GB (first PB) | AZs × hours, not secrets |
| CloudTrail | Extra trails, S3, SNS | First management-event copy free | Keep to the first copy |
You need a customer managed key for a custom key policy or cross-account reads, and the calling account pays for its use. A key per replica Region adds $2.00 a month for two replicas.
AWS recommends interface VPC endpoints for private subnets. Each bills hourly per Availability Zone, partial hours as full: 3 AZs × 720 hours × $0.01 = $21.60 a month, the price of 54 secrets. That can be a small team's largest adjacent line; interface endpoint charges covers the rest.
The alternative is the NAT gateway path, billed at NAT Gateway rates.
Secrets Manager vs Parameter Store pricing: which fits each value?
If a value doesn't need rotation, replication or a large size, Parameter Store is cheaper and often free. Priced in us-east-1:
| Option | Storage | API calls | Max size | 50 values, 1M reads | Choose it when |
|---|---|---|---|---|---|
| Secrets Manager | $0.40/secret | $0.05 per 10,000 | 65,536 bytes | $25.00 | Rotation, replication, over 8 KB |
| Parameter Store advanced | $0.05/parameter | $0.05 per 10,000 | 8 KB | $7.50 | Over 4 KB, policies, cross-account |
| Standard, higher throughput | Free | $0.05 per 10,000 | 4 KB | $5.00 | Reads above standard throughput |
| Standard | Free | Free | 4 KB | $0.00 | Everything else |
Standard holds up to 10,000 parameters per account and Region, advanced up to 100,000, and advanced can't be downgraded. Parameter Store counts each parameter a request returns as one API interaction: a Get returning ten is ten. Split a credential into six parameters and 1,000,000 reads become 6,000,000 interactions, $30.00 on a paid mode.
AWS's Startup Security Baseline agrees: Parameter Store with an AWS managed KMS key for frequently accessed secrets, Secrets Manager for those that benefit from automated rotation. Price the Parameter Store side with the AWS Systems Manager Pricing Calculator.
Find the secrets you pay for that nothing reads
DescribeSecret and ListSecrets return LastAccessedDate, to the day. It's omitted if the secret was never retrieved in that Region, so no date means never read. Since December 23, 2025, the console and ListSecrets can sort by it.
aws secretsmanager list-secrets \
--query "SecretList[].[Name,LastAccessedDate]" \
--output text | sort -k2
Secrets printing None, or an old date, are your candidates. The AWS Config rule secretsmanager-secret-unused flags them after 90 days by default, at Config's own charges.
Billing stops once deletion is scheduled, recovery window included, though the SecretCount CloudWatch metric keeps counting pending secrets for a while.
The money is modest: 15 forgotten secrets cost $72.00 a year in us-east-1. The better reason is that unused secrets "can be misused by former users", as AWS puts it. Cost allocation tags, a billing alarm or AWS Cost Anomaly Detection keep the line visible. CloudBurn's rule CLDBRN-AWS-SECRETSMANAGER-1 runs the never-accessed and 90-day check across a live account with cloudburn discover.
Catch new secret sprawl in the pull request
The properties that set this bill live in templates, as in AWS's replication example, trimmed and priced at us-east-1 rates:
MyReplicatedSecret:
Type: AWS::SecretsManager::Secret # one secret: $0.40/month
Properties:
Name: MyReplicatedSecret
ReplicaRegions:
- Region: us-east-1 # replica: +$0.40/month
KmsKeyId: alias/exampleAlias # customer managed key: +$1/month
- Region: us-east-2 # replica: +$0.40/month, aws/secretsmanager
On AWS::SecretsManager::RotationSchedule, HostedRotationLambda or RotationLambdaARN means a function billed at Lambda rates, run as often as RotationRules says. Before approving, ask:
- Could values with one consumer share a JSON secret?
- Does each replica Region run a workload that reads it independently?
- Does it need a customer managed key?
- Is managed rotation available instead of a Lambda?
Make these questions part of how you review cost decisions in the pull request.
Frequently Asked Questions
Does AWS Secrets Manager pricing vary by Region?
Why do some people say Secrets Manager costs $1 per secret?
Should I force-delete a secret to stop paying sooner?
Does BatchGetSecretValue lower API costs?
Do Secrets Manager EventBridge notifications cost extra?
What AWS Secrets Manager pricing comes down to
AWS Secrets Manager pricing is two rates and a count:
- Count secret-months: environments × Regions, plus service-created and forgotten secrets.
- Cache reads: at a 300-second TTL, each cache copy calls at most once every five minutes.
- Lambda rotation bills Lambda; managed rotation runs no function in your account.
- Values without rotation, replication or size needs fit Parameter Store standard at no additional charge.
- Delete unread secrets with a recovery window, which is free.
Next, enter your secret-months and post-cache call count in the calculator below. If customer managed keys are your bigger line, read customer managed KMS key pricing.
CloudBurn
Price Your Real Secret Count
CloudBurn's Secrets Manager calculator turns stored secrets, replicas included, and monthly API calls into a monthly figure for your region.