Secrets management · Comparison
AWS Secrets Manager vs Google Secret Manager
2 products compared side by side: what you pay for with each one first, then the five access facts, entry prices, recorded plan limits and the bottom line of each review. The evidence note under the table says how each product was checked.
Side by side
| Metric | AWS Secrets Manager | Google Secret Manager |
|---|---|---|
| What you're paying for | Compliance includedSecrets stored and rotated inside your AWS account, under AWS’s compliance programs, IAM controls and CloudTrail audit trail. | Worth the priceA pay-per-use secret store inside Google Cloud with a permanent free tier, IAM per secret and Google Cloud’s compliance coverage. |
| Overall score | 7.0 | 8.5Best |
| Free option | Free trial | Free plan |
| Card to start | –Not measured | –Not measured |
| Getting access | Self-serve | Self-serve |
| Starter priceCheapest paid plan | $0.40/secret/mo | $0.06/secret version/mo |
| Pricing model | Usage-based | Usage-based |
| Pricing page | Public prices | Public prices |
| Billing unit | Per secret per month and per 10,000 API calls | Per active secret version per location and per 10,000 access operations |
| Free option | No free tier of its own; up to $200 of AWS Free Tier credit for new accounts | Permanent free tier: 6 versions, 10,000 accesses, 3 rotation notifications a month |
| Reference scenario (monthly) | $85 (200 × $0.40 + 100 × $0.05), computed | $14.61 (194 × $0.06 + 99 × $0.03), computed |
| Machine identities | IAM roles and users, not billed | Service accounts and IAM principals, not billed |
| Audit log retention | CloudTrail event history, 90 days; trails to S3 for longer | Secret reads: 30 days once Data Access logs are on; admin activity 400 days |
| Dynamic secrets | Not offered | Not offered |
| Database rotation | Managed rotation for RDS, Aurora, DocumentDB and Redshift | Managed Cloud SQL rotation in Preview (regional secrets); Pub/Sub notifications otherwise |
| Kubernetes | Secrets Store CSI provider (ASCP), EKS add-on | Secret Manager add-on for GKE (CSI driver), sync to Kubernetes Secrets |
| SAML SSO / SCIM | IAM Identity Center, no extra charge | Through Cloud Identity Free; Entra ID provisioning guide |
| SOC 2 / ISO 27001 | SOC 1, 2, 3; ISO 27001, 27017, 27018 | SOC 1, 2, 3; ISO 27001, 27017, 27018 |
| HIPAA BAA | HIPAA-eligible under a BAA with AWS | Covered by the Google Cloud BAA, every account |
| EU data storage | Any EU region you choose | Regional secrets or user-managed replication in EU locations |
| Self-hosting | Not offered | Not offered |
| Secret export | One secret, or up to 20 per batch call | One version at a time |
| Bottom line | From its public pages, AWS Secrets Manager is a low-cost, widely certified secrets store for AWS workloads, at $85 a month for our scenario with native database rotation. It has no free tier of its own, no dynamic secrets and no push syncs beyond AWS. | From its public pages, Google Secret Manager is the lowest-cost option here, at $14.61 a month for our scenario, with a permanent free tier and Google Cloud’s compliance coverage. Rotation is mostly yours to build, and there are no dynamic secrets or push syncs. |
Evidence: AWS Secrets Manager: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Google Secret Manager: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run. Prices in USD as listed, excluding tax. "–" means not recorded.
When to pick each
In the words of each review, with the date its facts were checked.
From our AWS Secrets Manager review
Checked Oct 16, 2026- Pick AWS Secrets Manager when
- Your workloads are on AWS and you want managed rotation for RDS, Aurora, Redshift and DocumentDB.
- Pick Google Secret Manager when
- You run on Google Cloud and want a permanent free tier and $14.61 a month for the scenario.
From our Google Secret Manager review
Checked Oct 16, 2026- Pick Google Secret Manager when
- You run on Google Cloud and want a permanent free tier and $14.61 a month for the scenario.
- Pick AWS Secrets Manager when
- You run on AWS and want managed rotation for RDS, Aurora, Redshift and DocumentDB.
Entry price
Baseline: each product's cheapest paid plan, per month. Included usage differs, so read the line under each price.
- AWS Secrets ManagerPay as you go$0.40/secret/moPlus $0.05 per 10,000 API calls; prorated by the hour; replicas billed as secrets
- Managed rotation for RDS, Aurora, DocumentDB and Redshift
- New versions free; AWS managed KMS key free
- No charge for secrets scheduled for deletion
- Volume pricing through AWS sales
- Google Secret ManagerPay as you go$0.06/version/moPer active version per location; $0.03 per 10,000 access operations; $0.05 per rotation notification
- Management operations free; destroyed versions free
- Automatic replication billed as one location
- CMEK through Cloud KMS
- Custom quote on request
Prices as listed on each pricing page, in USD per month, excluding tax. Observed: AWS Secrets Manager 2026-10-16, Google Secret Manager 2026-10-16.
Which one fits
- If you need to start today without a sales call
- Google Secret ManagerSelf-serve sign-up; the highest score of the 2 self-serve products here (8.5/10).
- Lowest starter price
- Google Secret Manager$0.06/secret version/mo for the Pay as you go (plus $0.03 per 10,000 access operations) plan.
- Highest overall score
- Google Secret Manager8.5/10 (Excellent). The review shows the score breakdown and the run behind it.
Picked by fixed rules from the table above, not by hand. How we score
Full reviews
More in Secrets management
Add a product
Search by product name or by what it does, such as “email” or “feature flags”. 2 more fit in this comparison.