AWS Secrets Manager Pricing: $0.40 a Secret, Then the Calls

AWS Secrets Manager pricing has two lines: $0.40 per secret per month and $0.05 per 10,000 API calls. A replica of a secret in another region is billed as a separate secret, another $0.40. For most small apps that’s a few dollars, and if your bill shows a few dollars you can stop reading. If it shows a few hundred, the secrets are not the problem. The calls are, and so are two lines that don’t even say “Secrets Manager” on them.

Prices are from the AWS Secrets Manager pricing page and the AWS Price List for US East (N. Virginia), published September 11, 2026, checked today, November 5. A secret that exists for part of a month is prorated by the hour. Secrets scheduled for deletion are free, which the Secrets Manager user guide says in one sentence near the bottom.

What’s free and what isn’t

New versions are free. Rotating a secret every day doesn’t add storage cost, because AWS doesn’t charge per version. The rotation itself runs as a Lambda function (except for managed rotation), so you pay normal Lambda rates for that, which is usually cents.

Encryption with the default key, aws/secretsmanager, is free. Encryption with your own KMS key is not. AWS KMS pricing is $1 a month per customer managed key, prorated hourly, and $0.03 per 10,000 requests after a free 20,000 a month across all regions. Every GetSecretValue on a secret encrypted with your own key makes Secrets Manager call KMS to decrypt it. So with a custom key, each call costs $0.05 plus $0.03 per 10,000, and that second part shows up under KMS on the bill, not under Secrets Manager. Teams looking for the cost of their secrets in Cost Explorer filter by service and miss it.

The third line is the VPC endpoint. A Lambda function inside a VPC with no NAT gateway can’t reach Secrets Manager at all, and the fix in the docs is an interface endpoint. PrivateLink pricing is $0.01 an hour for each endpoint network interface, one per Availability Zone. Three AZs is $21.90 a month. That’s more than 54 secrets cost, and it’s billed under VPC.

A worked example

This one is hypothetical, but every part of it is common. A startup runs its API on Lambda behind API Gateway, 30 million invocations a month. It keeps 40 secrets: 20 for production and 20 for staging (database URL, Stripe key, email provider key, a JWT signing key, and so on). The functions run in a VPC with a Secrets Manager endpoint in three AZs, and someone with a security checklist moved every secret onto one customer managed KMS key.

The handler fetches two secrets with the SDK at the top of every invocation. That’s the line that hurts.

Line	Usage	Cost
Secrets	40 × $0.40	$16.00
Secrets Manager API calls	60,000,000 ÷ 10,000 × $0.05	$300.00
KMS key	1 × $1	$1.00
KMS requests	(60,000,000 − 20,000) ÷ 10,000 × $0.03	$179.94
Interface endpoint	3 AZs × 730 h × $0.01	$21.90
Total		$518.84

Of $518.84, the secrets themselves are $16. Look at the order of those numbers before you look at anything else.

The fix is a cache, and AWS ships one

Nobody needs the database password fetched 60 million times a month. It changes when it rotates, which is every 30 days if you rotate at all.

The AWS Parameters and Secrets Lambda Extension is a layer you add to the function. Your code asks localhost:2773 instead of Secrets Manager, and the extension keeps the value for 300 seconds by default (SECRETS_MANAGER_TTL, maximum 300), up to 1,000 secrets. Powertools for Lambda does the same inside your code, but note its default cache is 5 seconds, so set maxAge or you’ve saved very little. Outside Lambda, the AWS caching clients for Java, Python, Go and .NET, or just a module-level variable in Node with a timestamp next to it, do the job.

With the extension and about 50 execution environments alive at any moment, each one refreshes two secrets every 5 minutes: 50 × 2 × 12 × 730 = 876,000 calls a month. API calls drop to $4.38 and KMS requests to about $2.57. The bill goes from $518.84 to $45.85, and the function gets faster because it stops making a network call before doing any work.

One honest caveat. A 5-minute cache means a rotated password can be up to 5 minutes stale. With alternating-users rotation that’s fine, the old credentials keep working until the next rotation. With single-user rotation it isn’t, and you’d want a shorter TTL or a retry that refetches on an auth error. We’d take the retry.

Does it have to be Secrets Manager?

Not for everything. Parameter Store standard parameters cost nothing to store, and API calls at standard throughput are free. A SecureString parameter is encrypted with KMS like a secret. What you give up is built-in rotation, cross-region replication and resource policies.

Our rule: anything that rotates (database credentials, especially RDS ones Secrets Manager can rotate for you) stays in Secrets Manager. A third-party API key that only changes when someone pastes a new one in can live in Parameter Store for $0. In the example, if 20 of the 40 secrets were that kind of key, moving them saves another $8 a month. Small, but it’s $8 for a 20-minute change, and the staging copies often turn out to be secrets nobody has read in a year.

The endpoint is worth one question too. If those functions already sit behind a NAT gateway, the endpoint was added for security or to avoid NAT data charges on secret calls, which after caching are a few megabytes. If your security policy needs it, keep it. If nobody remembers why it’s there, $21.90 a month says ask.

Finding it on your own bill

In Cost Explorer, filter by service “Secrets Manager” and group by usage type. In N. Virginia you’ll see USE1-AWSSecretsManager-Secrets and USE1-AWSSecretsManagerAPIRequest (Frankfurt says EUC1-, and so on). Then do the step people skip: switch the filter to “Key Management Service” and look at the requests line, and to “VPC” for the endpoint hours. If the API line divided by $0.05 per 10,000 comes close to your request count, you’re fetching on every request.

CloudTrail logs every GetSecretValue as a management event, so the event history shows which role makes the calls. The noisy one is nearly always a Lambda function or a container that reads secrets per request instead of at startup.

Our Secrets Manager pricing calculator puts in all five lines from this post, KMS and the endpoint included. If this is one line on a bigger AWS bill, the free cloud cost audit ($0, we read the bill lines, no logins) tells you what we’d cut first, and we reduce startup AWS bills for $0 up front, paid from 50% of the verified monthly saving for 6 months.