Tool profile
Google Secret Manager: cost, fit and limits
Google Secret Manager is a Google Cloud service for storing API keys, passwords and certificates as versioned secrets, controlled through Cloud IAM and audit logs. Secrets can be global or regional, optionally encrypted with customer-managed keys from Cloud KMS, and billed by active versions and access operations.
What to know first
Google Secret Manager is a plain secrets store inside Google Cloud, with versioning and IAM as its center. A secret is a global resource holding labels, permissions and numbered versions, and regional secrets keep data in a chosen location for residency needs. Billing dimensions are active secret versions, access operations and rotation notifications, with a free tier, but the pricing page read was truncated and showed no rates. Rotation is announced rather than performed.
Google Secret Manager at a glance
| Maker | Google, United States |
|---|---|
| Free plan | Yes |
| Entry price | Quote only |
| API access | Yes |
| Category | Best AI Secrets Management Software in 2026, rank 8 of 10 |
| Website | cloud.google.com/secret-manager |
Who Google Secret Manager is best for
Google Cloud developers
Roles such as secretAccessor and secretVersionManager can be granted per project or per secret, and workloads on Google Cloud reach secrets through their service accounts.
Teams with data residency rules
Regional secrets keep data in a specific location, and customer-managed encryption keys for regional secrets must sit in the same location.
Teams needing rollbacks
Each version has an ID or timestamp, supports aliases and pinning to workloads, and can be disabled or destroyed, so a bad credential can be reverted quickly.
Config-heavy applications
Parameter Manager stores application configuration and can reference secrets, which separates settings from credentials in one Google Cloud workflow. That helps keep credentials out of settings files.
Google Secret Manager plans and pricing
| Plan | Price | What it includes |
|---|---|---|
| Active secret versions | Billed per version per month; rate not readable | Each active version counts. Disabled or destroyed versions stop counting, which is one reason to clean up old versions. |
| Access operations | Billed per operation; rate not readable | Every read of a secret version is an access operation, so caching in the application lowers the bill. |
| Rotation notifications | Billed per notification; rate not readable | Rotation schedules publish notifications to a topic, and your own function or service creates the new version. |
| Free tier | Listed, amounts not readable | The pricing page summary lists a free tier, but the allowance figures could not be read. |
Checked November 2026.
What Google Secret Manager does
- Global and regional secrets
- The default is a global resource. Regional secrets keep payloads in a named location, which helps data residency and sovereignty requirements. Pick the model per secret.
- Replication choices
- Automatic replication lets Google choose regions and bills for one location. User-managed replication lets you pick regions and bills per location. Choose based on residency needs.
- Customer-managed keys
- Secrets can be encrypted with keys from Cloud KMS that you generate or import. For regional secrets, the key must be in the same location.
- Fine-grained IAM
- Roles and conditions separate who may access, manage, audit and rotate secrets, at project or individual secret level, which supports separation of duties. Auditing is available through Cloud Audit Logs.
- Always encrypted
- The overview says secret data is always encrypted before it is persisted to disk, with AES-256 at rest and HTTPS in transit, and no setup is required.
How Google Secret Manager handles your data
Google's overview says Secret Manager always encrypts secret data before it is persisted, using AES-256 at rest and HTTPS in transit, and allows optional customer-managed keys from Cloud KMS. Global secrets are replicated automatically or to regions you choose, and regional secrets keep data in a specific location for residency and sovereignty requirements. The documentation read does not list compliance certifications, retention for destroyed versions or AI data use for this service. Google's privacy policy names Google Ireland Limited as controller for EEA users, and Google lists its headquarters in Mountain View, California.
Where Google Secret Manager falls short in practice
- Rotation is your code. The overview recommends rotation but describes no managed rotation engine. A schedule sends a notification, and your function must create the new version and update the target system.
- Pricing needs the calculator. The pricing page read was truncated, so version and access rates are unverified here. Teams with many versions or frequent reads should model costs before adopting.
- Google Cloud identity centered. IAM roles and service accounts are the native access path. Workloads on other clouds or on-premise need workload identity federation or keys, which adds setup.
Works with
Alternatives to Google Secret Manager
Google Secret Manager: common questions
Does Google Secret Manager rotate secrets by itself?
Not in the documentation page read. You can set a rotation schedule that publishes notifications, but your own code must create the new secret version and update the downstream system. The overview recommends rotation without describing automated mechanics. Plan for that engineering work.
What is a regional secret?
A regional secret keeps its data in a specific location to meet data residency and sovereignty requirements, unlike the default global secret. If you use customer-managed keys for a regional secret, the Cloud KMS key must be in the same location.
How are secret versions handled?
Each version has a unique ID or timestamp. Versions support rollback to a known-good state, an audit history of changes, pinning to workloads and aliases. Unneeded versions can be disabled or destroyed, and billing counts active versions. Cleaning up old versions lowers cost.
Can I use my own encryption keys?
Yes. Secrets can be encrypted with customer-managed encryption keys from Cloud KMS, which you generate or import. Secret Manager still encrypts all data before it is persisted, with AES-256 at rest when you do not configure a key. Key location matters for regional secrets.
What does Google Secret Manager cost?
The pricing page summary lists billing by active secret versions per month, access operations and rotation notifications, with a free tier. The rates were not readable when we opened it, so check the page or the Google Cloud pricing calculator.