Tool profile
AWS Secrets Manager: cost, fit and limits
AWS Secrets Manager is a managed secrets service made by Amazon Web Services that stores credentials and API keys, controls access through IAM, rotates secrets on demand or on a schedule and replicates them to other regions. It is billed per stored secret and per API call.
What to know first
AWS Secrets Manager is the simplest pricing model in this category: $0.40 per secret per month and $0.05 per 10,000 API calls, with no seat fee. New accounts receive up to $200 in AWS Free Tier credits. Rotation works for AWS and third-party services without redeploying applications, but every rotation call counts toward the API charge. The service has no agent-specific features on its product page.
AWS Secrets Manager at a glance
| Maker | Amazon Web Services, United States |
|---|---|
| Free plan | Free trial only |
| Entry price | $0.40 per secret per month plus $0.05 per 10,000 API calls |
| API access | Yes |
| Category | Best AI Secrets Management Software in 2026, rank 5 of 10 |
| Website | aws.amazon.com/secrets-manager/ |
Who AWS Secrets Manager is best for
Teams fully on AWS
Access is controlled through IAM permissions policies, and logging, monitoring and notification services connect for auditing and alerting. That fits teams with existing AWS alarms.
Small workloads with few secrets
With $0.40 per secret per month, ten secrets cost $4 a month before API calls, which suits small services more than a per-seat tool.
Disaster recovery planners
Secrets can be copied to other locations, which supports failover into a second region without manual copying. Teams in regulated sectors often need that.
Database-heavy applications
Rotation for AWS and third-party services can run on demand or on a schedule, so database passwords can change without a redeploy.
AWS Secrets Manager plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| Secret storage | $0.40 per secret per month | Each stored secret is billed monthly, and creating new versions of a secret is not charged. |
| API calls | $0.05 per 10,000 calls | Reads, writes and rotation calls count as API calls, so a busy application that fetches on every request pays more than one that caches. |
| Free Tier credits | Up to $200 in credits | New AWS accounts can apply credits to eligible services, including Secrets Manager. A free plan is available for 6 months and credits must be used within 12 months. |
Checked November 2026.
What AWS Secrets Manager does
- IAM-based access
- Fine-grained permissions policies decide which roles can read or change each secret. The model is powerful inside AWS but needs identity federation for workloads that run elsewhere.
- Managed rotation
- Secrets for AWS and third-party services can rotate without interrupting running applications. Rotation creates a new secret version, and version creation itself is free. Check each target service.
- Cross-region replication
- Copies in other locations support disaster recovery. The pricing page read did not describe replication charges, so check the calculator before enabling it widely. Check that your target region is supported.
- Auditing integrations
- Secrets connect with AWS logging, monitoring and notification services, so access events and rotation failures can feed alarms and compliance reports. Auditing therefore needs no extra agent.
- Centralized lifecycle
- The product page frames the service as managing the lifecycle of secrets from one console, which replaces secrets kept in code or configuration files. It replaces credentials kept in code or config files.
How AWS Secrets Manager handles your data
AWS's compliance programs page lists SOC 1, SOC 2 and SOC 3, ISO 27001 with related ISO standards, and PCI DSS programs, assessed by third-party auditors, though it covers AWS as a whole rather than this service alone. The Secrets Manager product page mentions encryption at rest and central auditing but names no key service, retention period or AI data use. The AWS privacy notice names Amazon Web Services, Inc. in Seattle, and Amazon Web Services EMEA SARL in Luxembourg as the controller for EEA, UK and Swiss users.
Where AWS Secrets Manager falls short in practice
- Tied to AWS identity. Access depends on IAM, so workloads on other clouds or on-premise need federation or access keys, and the secrets then sit behind a system your other teams may not know.
- Costs rise with call volume. An application that fetches a secret on every request pays per call. Caching in the client reduces charges, but it adds code that a platform team must maintain.
- No agent features described. The product page read does not mention AI or agent credentials. Teams giving secrets to coding assistants must design scoping and expiry on top. Short-lived tokens must come from your own tooling.
Works with
Alternatives to AWS Secrets Manager
AWS Secrets Manager: common questions
How much does AWS Secrets Manager cost?
The pricing page lists $0.40 per secret per month and $0.05 per 10,000 API calls. Creating new secret versions is not charged, but rotation calls count as API calls. New accounts can use up to $200 in Free Tier credits.
Does AWS Secrets Manager rotate secrets automatically?
Yes. The product page says secrets for AWS and third-party services can be rotated on demand or on a schedule without redeploying or interrupting running applications. Each rotation creates a new version, and the calls used for rotation are billed at the API rate.
Which compliance programs does AWS list?
The compliance programs page lists SOC 1, SOC 2 and SOC 3, ISO 27001 with ISO 27017 and 27018, and PCI DSS, PCI 3DS, PCI P2PE and PCI PIN, each assessed by an independent auditor. Check whether Secrets Manager is in scope for your report.
Can I replicate secrets across regions?
Yes. The product page says secrets can be copied to other locations to support disaster recovery. The pricing page read did not mention replication fees, so use the AWS pricing calculator or ask your account team before enabling it for many secrets.
Is the Free Tier permanent?
No. The pricing page says new accounts receive up to $200 in AWS Free Tier credits, that a free plan is available for 6 months after account creation, and that credits must be used within 12 months. After that, standard rates apply.