Free calculator
AWS Secrets Manager pricing calculator
Secrets Manager costs $0.40 per secret a month and $0.05 per 10,000 API calls. That part is small. What makes the bill big is usually the calls, and the two lines that come with them under other names: KMS requests when the secrets use your own key, and the VPC endpoint. This puts all of them in one place.
Estimated monthly cost of your secrets
$0
Prices for US East (N. Virginia) from aws.amazon.com/secrets-manager/pricing and the AWS Price List (Secrets Manager published 2026-09-11, KMS 2026-10-26), checked 2026-11-05. Secrets Manager: $0.40 per secret per month, prorated by the hour, replicas billed as separate secrets; $0.05 per 10,000 API calls; secrets scheduled for deletion and the default aws/secretsmanager key are free. KMS: $1 a month per customer managed key, $0.03 per 10,000 requests after 20,000 free a month (the free requests are shared with everything else in the account, so treat them as an upper bound). Interface endpoint: $0.01 an hour per Availability Zone over 730 hours; its $0.01 per GB of data is left out because secrets are a few KB. The cached estimate assumes every environment refreshes each secret every 300 seconds, the Lambda extension's default. Not included: rotation Lambda runs, CloudTrail trails beyond the free one, and new-account Free Tier credits.
Why the bill grows
The secret count rarely does it. Forty secrets is $16. Calls do it, because the easy way to write a handler is to fetch the secret at the top of every request, and then the call count is your traffic multiplied by the number of secrets. Thirty million Lambda invocations reading two secrets each is 60 million calls, $300 a month, for values that change once a month at most.
If the secrets use your own KMS key, every one of those calls also makes a KMS decrypt, billed under Key Management Service at $0.03 per 10,000. That line can be most of the size of the Secrets Manager one, and people miss it because they filter Cost Explorer by service. The VPC endpoint is the third: $7.30 a month per Availability Zone, whether you make ten calls or ten million.
The fix is a cache. The AWS Parameters and Secrets Lambda Extension keeps each value for up to 300 seconds, and the same idea works anywhere with a variable and a timestamp. Things that never rotate, like a third-party API key, can also move to Parameter Store standard parameters, which cost nothing to store or read at standard throughput.
The full example, $518.84 a month down to $45.85, is in AWS Secrets Manager pricing: $0.40 a secret, then the calls. If secrets are one line on a bigger AWS bill, our free cloud cost audit reads the whole bill, and we cut startup AWS bills for $0 up front, paid from half the verified saving for 6 months.