# AWS Secrets Manager Pricing: Cost Per Secret (2026)
By Femi Adegoke · 2026-11-05 · Source: https://www.activepieces.com/blog/aws-secrets-manager-pricing-cost-per-secret-2026
---
AWS Secrets Manager bills on two meters: a flat monthly charge for each secret you store, and a small fee for every 10,000 API calls.
At the long-standing rates of $0.40 per secret per month and $0.05 per 10,000 calls, the per-secret charge is what drives most bills, because it accrues whether or not anything reads the value.
That is why a sprawl of rarely used credentials, such as the API keys left behind by workflow tools like [Activepieces](https://www.activepieces.com) and the per-environment copies of every database password, costs more than the call volume ever does.
Consolidating related values into one JSON secret, deleting stale entries, and checking rotation schedules are the cheapest ways to bring the total down.
AWS Secrets Manager pricing is a usage-based billing model in which you pay a flat monthly fee for each stored secret, plus a smaller charge per 10,000 API calls, so the number of secrets you keep drives most of the cost.
TITLE: AWS Secrets Manager Pricing 2026: Per-Secret Cost Wins
TITLE: AWS Secrets Manager Pricing 2026: Per-Secret Cost Wins
According to AWS, Secrets Manager bills per secret stored each month, with a smaller metered charge per 10,000 API calls. A small team's bill therefore tracks how many secrets it keeps, not how often it reads them. Replicas count as extra secrets.
You hand AWS Secrets Manager credentials such as database passwords and API keys, and it stores, encrypts, rotates and serves them to your applications.
The table below lays out each billed line by its unit, so you can see which one scales with your habits.
[Activepieces](https://www.activepieces.com) bills a flow run as 1 credit however many steps it has, but if you automate rotation with it, the calls still bill on the AWS side.
| Line item | Unit billed | What makes it grow | Limit that matters |
|---|---|---|---|
| Secrets stored | Per secret, per month | Every separate secret you create and never delete | 65,536 bytes per secret value |
| API calls | Per 10,000 calls | Application reads, rotation checks | 100 versions per secret |
| Replica secrets | Per replica, per month | Each region you copy a secret into | Billed like a separate stored secret |
| Free trial | One-time, for new accounts | Only during the trial window | Ends, then standard billing starts |
Watch the stored-secret line, because it charges for existence, not use. A secret nobody has read in a year costs the same as your busiest one.
AWS bills API calls in blocks of 10,000, so a small team's read traffic rarely becomes the dominant charge.
Do not mistake the trial for a baseline. It applies to new accounts and offsets storage and calls for a limited period, so treat it as a way to test.
### Quotas and limits from the AWS docs
Because a single secret holds up to 65,536 bytes, several related values can share one secret as a JSON document instead of each getting its own.
Each secret keeps up to 100 versions, which is ample headroom for rotation history and no reason to create extra secrets for it.
## One monthly bill for a five-person team's workload
At [AWS's pricing page](https://aws.amazon.com/secrets-manager/pricing/) rates, a team running 40 secrets and 2 million API calls a month pays $26. That's $16 for storage and $10 for calls, so the stored count already outweighs traffic.
Two units get metered directly: **$0.40 per secret per month** and $0.05 per 10,000 API calls, so these are your main cost optimization levers.
I priced four workloads a small team might plausibly run:
- 10 secrets with 50K calls
- 20 with 500K
- 40 with 2M
- 100 with 1M
### Line-by-line arithmetic
At ten secrets, storage costs $4 and calls $0.25. Calls are about 6% of a $4.25 bill, so there's nothing to optimise on the API side.
Raise it to twenty secrets and storage is $8 against $2.50 in calls, making storage the primary cost lever. Calls are still under a quarter of the $10.50 total.
At forty secrets the gap is closest, $16 against $10, marking the inflection point where storage and call expenses are most balanced. Storage still carries 62% of the $26 bill.
Go to one hundred secrets and storage alone is $40, against $5 in calls. That's $45 a month, $19 more than the 40-secret team, even though it makes half the calls.
**Counting secrets, not requests, explains the gap, and cutting 100 secrets to 40 removes $24 a month with no change in traffic.**
### When API calls overtake storage
Once each secret is **read more than 80,000 times a month**, calls start to dominate, because that's how many calls $0.40 buys. At 40 secrets that means 3.2 million calls, 1.2 million more than the workload above. At 100 secrets it means 8 million.
If your team sustains traffic at that level, for example by fetching a secret on every request instead of caching it, the claim fails for you. Caching is the first fix. Below that level, the number of stored secrets sets your bill.
## Charges that scale your Secrets Manager bill
Outside the per-secret and per-call rates sit six charges, and most of them grow with the number of secrets, regions or private networks you run. The list below names each one so you can check it against your own invoice.
- Deleted secrets, still billed through the minimum 7-day recovery window
- A replica in each extra region, billed as another secret
- KMS key charges and KMS request charges
- The rotation Lambda function's compute
- VPC endpoint or NAT gateway hours and data processing
- Cross-region and internet data transfer
Consolidating secrets shrinks the per-secret charges, which is why pruning comes before any tool switch.
Pick the default AWS managed key and there is no monthly key fee. A customer managed key adds one, and every decrypt adds a request charge. Caching secret values in your application cuts both.
With two extra regions the count triples, because AWS bills each replica like a secret. A deleted secret keeps billing for at least 7 days, so churning short-lived test secrets costs a week each. Rotation adds Lambda invocations per rotating secret.
When workloads in private subnets reach Secrets Manager, they go through a NAT gateway, which bills per hour and per GB processed, or through an interface endpoint, which bills per hour per Availability Zone.
The endpoint cost is fixed and every secret shares it, so it matters most to teams with few secrets.
[AWS publishes](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_limits.html) very different ceilings by operation:
- Update and put allow 50 requests per second, so a migration script looping over hundreds of secrets will throttle unless it backs off.
- GetSecretValue allows 10,000 requests per second, so a small team's reads will almost never hit the limit.
- DescribeSecret allows 40,000, which leaves inventory and audit scripts plenty of room.
At up to 64 KB, a secret value has room for a JSON document with dozens of keys, so you can consolidate most configuration as single secrets.
## The strongest case that Secrets Manager is overpriced
The obvious objection is that AWS already sells a store with no per-item fee. **Parameter Store standard parameters cost nothing to keep**, while Secrets Manager meters 40 secrets at $0.40 each, or $16 a month.
viz type=stackrank title="Monthly cost of running HashiCorp Vault" unit="$ per month" source="ThePricer, Perimattic - https://www.thepricer.org/how-much-does-an-aws-server-cost/" target="16" benchmark="40 secrets in Secrets Manager: $16"5 managed basic tier and close to the $29 standard tier."
Managed basic: 15
EC2 with storage: 22.11
Managed standard: 29
The table prices the same 40 secrets across five options as of November 2026. The gap that matters is between metering each secret and metering only operations or hosting. Only the first scales with how many values you store.
| Option | Cost for 40 secrets | Rotation | Max size | Sharing |
|---|---|---|---|---|
| Secrets Manager | $16/month | Built in | 64 KB | Cross-account via policy |
| Parameter Store standard | $0 | None built in | 4 KB | Same account |
| Google Secret Manager | $2.40/month | Scheduled notifications | 64 KiB | IAM-based |
| Azure Key Vault | Cents at light read volume | Rotation policy, event-driven | 25 KB | Access policies or RBAC |
| HashiCorp Vault | $15 to $29/month | Dynamic secrets | Configurable | Policy-based |
When storage is free, the choice is no longer about price, only about whether you need rotation and cross-account access.
If the value is a database URL or API key, it fits in the 4 KB a standard parameter holds, but a certificate bundle may not.
That limit, plus the lack of built-in rotation, is what the $16 buys back. If your 40 values never rotate, the argument holds.
At $0.06 per active secret version, Google charges $2.40 a month for 40 secrets with one live version each, about 85% less than AWS.
Azure meters operations, not stored secrets, so a small team's bill is cents. In both cases the unit isn't the secret, and consolidation matters less there.
### HCP Vault Secrets and self-hosted Vault
Until you price the hosting, Vault looks cheaper. [ThePricer](https://www.thepricer.org/how-much-does-an-aws-server-cost/) lists a managed basic tier at $15 a month and a standard tier at $29, so even the cheapest managed plan roughly matches the $16 you would pay AWS.
Self-hosting doesn't beat it either. EC2 compute alone runs $15.26 a month, and adding storage brings it to $22.11, which means anyone storing data pays $22.11. That's before the hours you spend patching and unsealing it.
Switching tools therefore saves little at 40 secrets, and consolidating the AWS bill comes first.
## Why Secrets Manager still wins for rotating credentials
**Pay the per-secret fee for credentials that rotate**, because Secrets Manager does the rotation itself, and stop paying it for static values that never change.
Cutting the secret count was never an argument against the service. It was an argument against storing the wrong things in it.
### Where per-secret pricing pays for itself
Since the unit billed is the stored secret, the question is what each one buys you. When a database password rotates, it earns its fee several ways.
Secrets Manager runs a Lambda rotation function on a schedule, and for RDS it ships a native integration. You don't write the rotation logic or keep the credential in sync with the database yourself.
That removes a recurring maintenance job and the outage risk of a botched manual change.
In the illustration below, one such secret, `db/prod/orders`, sits on a 30-day rotation cycle. The clock triggers a Lambda function that updates the RDS database, while a resource policy tag and a replica in a second region hang off the same secret.
Take from it that one billed secret carries rotation, access control and replication together.
For a secret that rotates and is read by several services, the fee replaces engineering time you would otherwise spend.
### When Parameter Store beats Secrets Manager
**Put static configuration in Parameter Store**. A feature flag, a service endpoint or an API key you rotate by hand once a year gains nothing from the rotation machinery, replication or per-secret policies.
For a secret that rotates and is read by several services, the fee replaces engineering time you would otherwise spend.
Each one is still billed as a full secret. Those values are where the overspending from earlier comes from.
Under one condition the claim flips: the value never rotates and needs none of the other features. Then you're paying the per-secret rate for storage alone, and a free or cheaper parameter does the same job.
Sort your secrets by that test first, keep the rotating ones, and move the rest.
## Cut a Secrets Manager bill on Monday, with Activepieces
Start with the unit you're billed on, which is each stored secret, and work through the steps below in order, because every deletion or merge lowers the bill directly.
1. List every secret with its last-accessed date.
2. Delete the ones nobody reads, using the recovery window as your safety net.
3. Bundle related keys into single JSON secrets.
4. Move static values to Parameter Store.
5. Enable client-side caching.
6. Set a budget alert.
Pull the list and sort by last-accessed date. A secret nobody has read in months is a monthly charge for nothing.
Delete it, and if something breaks, restore it within the recovery window. That window is why pruning is low-risk: a wrong call costs you a restore, not an outage.
### Reduce Secrets Manager costs by consolidating secrets
Store a database host, user, and password as three secrets and you're billed for three. Store them as one JSON secret and you're billed for one, and your application parses the fields.
If a value never rotates, such as an endpoint or a feature flag, it doesn't need Secrets Manager at all, so move it to Parameter Store.
Then turn on caching in your client so repeated reads of the same secret stop generating needless calls. Calls aren't the main cost driver, but caching also makes the consolidated secrets faster to read.
Finally, set a budget alert so a new secret-per-value habit shows up as a notification rather than a surprise invoice.
### Automate the unused-secret review
To run this review for you, use Activepieces, an open-source workflow automation tool. A scheduled flow can call the AWS API, collect secrets whose last-accessed date is stale, and post the list to a chat channel or open a ticket.
Here Activepieces is glue: it doesn't delete anything, consolidate keys, or change what AWS charges, and a short script on a scheduler would do the same job. Its value is that the review happens every month without anyone remembering to run it.
## Frequently asked questions
Even with the monthly review catching most waste, a few billing questions come up often enough to settle here. These four are worth checking against the current pricing page before you trust any estimate:
- Whether the free trial still applies to your account, given the change to credit-based free plans for new accounts in July 2025
- Whether secrets in their deletion recovery window still bill
- Whether calls served from a client-side cache still count as API calls
- At what point per-secret pricing stops making sense and a different tool is worth evaluating
Does Secrets Manager charge for failed API calls? I can't confirm that from the pricing page, which meters API calls without separating failures. Treat them as billable until your own bill shows otherwise.
Retry loops hitting a misconfigured permission are a cheap thing to fix either way. Caching on the client side cuts the call count regardless.
Is there a free tier for AWS Secrets Manager? Historically it was a trial period per new secret. New accounts created after July 15, 2025 are on a credit-based free plan instead.
Check which one your account falls under. Once it ends, you pay per stored secret, so the trial hides the real cost of one-secret-per-value sprawl.
Do deleted secrets still cost money? Possibly, during the recovery window. A secret scheduled for deletion hasn't yet been removed, and the pricing page is the place to confirm how that period is metered.
If you're certain a secret is dead, deleting it without a recovery window removes the question.
### Is Secrets Manager cheaper than HashiCorp Vault?
It depends on the unit. Secrets Manager bills per secret stored plus API calls, with no servers to run. Vault's cost is infrastructure and the hours spent operating it, whether you self-host or pay for a managed offering.
For a small team with a modest secret count, the operating time usually outweighs the per-secret fees. That changes only after consolidation has shrunk the secret count and the bill is still too high.
Are replica secrets billed as separate secrets? Yes. Each replica in another region is billed as its own secret, so replicating a large set multiplies the count. Replicate only the secrets a failover region needs.
## Related reading
- [DeepSeek Search API vs Exa Pricing for Small Teams (2026)](https://www.activepieces.com/blog/deepseek-search-api-vs-exa-pricing-for-small-teams-2026)
- [No-Code Automation Statistics 2026: Adoption for Small Teams](https://www.activepieces.com/blog/no-code-automation-statistics-2026-adoption-for-small-teams)
- [AI Project Manager Tools: Best Picks for 2026](https://www.activepieces.com/blog/ai-project-manager-tools-best-picks-for-2026)
## References
- [AWS](https://aws.amazon.com/secrets-manager/pricing/)
- [ThePricer, Perimattic](https://www.thepricer.org/how-much-does-an-aws-server-cost/)
- [AWS](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_limits.html)