Secrets management · Comparison

AWS Secrets Manager vs Google Secret Manager vs Infisical

3 products compared side by side: what you pay for with each one first, then the five access facts, entry prices, recorded plan limits and the bottom line of each review. The evidence note under the table says how each product was checked.

Side by side

AWS Secrets Manager vs Google Secret Manager vs Infisical: value, access facts, plan limits and bottom lines
Metric	AWS Secrets Manager	Google Secret Manager	Infisical
What you're paying for	Compliance includedSecrets stored and rotated inside your AWS account, under AWS’s compliance programs, IAM controls and CloudTrail audit trail.	Worth the priceA pay-per-use secret store inside Google Cloud with a permanent free tier, IAM per secret and Google Cloud’s compliance coverage.	Saves engineering timeAn open-source secrets platform with syncs, rotation and dynamic secrets that you can use in its cloud or run yourself.
Overall score	7.0	8.5Best	6.8
Free option	Free trial	Free plan	Free plan
Card to start	–Not measured	–Not measured	No card needed
Getting access	Self-serve	Self-serve	Self-serve
Starter priceCheapest paid plan	$0.40/secret/mo	$0.06/secret version/mo	$20/identity/mo
Pricing model	Usage-based	Usage-based	Per seat
Pricing page	Public prices	Public prices	Public prices
Billing unit	Per secret per month and per 10,000 API calls	Per active secret version per location and per 10,000 access operations	Per identity (human or machine) per month
Free option	No free tier of its own; up to $200 of AWS Free Tier credit for new accounts	Permanent free tier: 6 versions, 10,000 accesses, 3 rotation notifications a month	Free: 5 identities, 10 syncs; 30-day trial of paid plans, no card
Reference scenario (monthly)	$85 (200 × $0.40 + 100 × $0.05), computed	$14.61 (194 × $0.06 + 99 × $0.03), computed	$300 on Pro (15 × $20, annual), computed
Machine identities	IAM roles and users, not billed	Service accounts and IAM principals, not billed	Billed like users; machines with identical permissions can share one
Audit log retention	CloudTrail event history, 90 days; trails to S3 for longer	Secret reads: 30 days once Data Access logs are on; admin activity 400 days	None on Free, 30 days on Pro, 90 on Advanced, custom on Enterprise
Dynamic secrets	Not offered	Not offered	Advanced ($40 per identity)
Database rotation	Managed rotation for RDS, Aurora, DocumentDB and Redshift	Managed Cloud SQL rotation in Preview (regional secrets); Pub/Sub notifications otherwise	Pro for public databases; full rotation on Advanced
Kubernetes	Secrets Store CSI provider (ASCP), EKS add-on	Secret Manager add-on for GKE (CSI driver), sync to Kubernetes Secrets	Operator, Agent Injector and CSI provider; External Secrets provider
SAML SSO / SCIM	IAM Identity Center, no extra charge	Through Cloud Identity Free; Entra ID provisioning guide	SAML on Pro; SCIM on Enterprise
SOC 2 / ISO 27001	SOC 1, 2, 3; ISO 27001, 27017, 27018	SOC 1, 2, 3; ISO 27001, 27017, 27018	SOC 2 Type II; no ISO 27001 stated
HIPAA BAA	HIPAA-eligible under a BAA with AWS	Covered by the Google Cloud BAA, every account	HIPAA compliance stated; BAA by agreement, plan not stated
EU data storage	Any EU region you choose	Regional secrets or user-managed replication in EU locations	EU cloud region (eu.infisical.com)
Self-hosting	Not offered	Not offered	MIT-licensed core free; enterprise features need a license
Secret export	One secret, or up to 20 per batch call	One version at a time	CLI export as dotenv, CSV, JSON or YAML
Bottom line	From its public pages, AWS Secrets Manager is a low-cost, widely certified secrets store for AWS workloads, at $85 a month for our scenario with native database rotation. It has no free tier of its own, no dynamic secrets and no push syncs beyond AWS.	From its public pages, Google Secret Manager is the lowest-cost option here, at $14.61 a month for our scenario, with a permanent free tier and Google Cloud’s compliance coverage. Rotation is mostly yours to build, and there are no dynamic secrets or push syncs.	From its public pages, Infisical pairs broad rotation, syncs and dynamic secrets on self-serve plans with an MIT core to self-host and an EU region. Every identity is billed, audit logs start on Pro with 30 days, and SCIM and SIEM streaming need Enterprise.

Evidence: AWS Secrets Manager: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Google Secret Manager: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Infisical: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run. Prices in USD as listed, excluding tax. "–" means not recorded.

When to pick each

In the words of each review, with the date its facts were checked.

From our AWS Secrets Manager review
Checked Oct 16, 2026
Pick AWS Secrets Manager when
Your workloads are on AWS and you want managed rotation for RDS, Aurora, Redshift and DocumentDB.
Pick Google Secret Manager when
You run on Google Cloud and want a permanent free tier and $14.61 a month for the scenario.
From our AWS Secrets Manager review
Checked Oct 16, 2026
Pick AWS Secrets Manager when
You want one service per AWS account with IAM controls and no per-identity fee.
Pick Infisical when
You want dynamic secrets, syncs across clouds and an MIT core you can self-host.
From our Google Secret Manager review
Checked Oct 16, 2026
Pick Google Secret Manager when
You run on Google Cloud and want a permanent free tier and $14.61 a month for the scenario.
Pick AWS Secrets Manager when
You run on AWS and want managed rotation for RDS, Aurora, Redshift and DocumentDB.
From our Google Secret Manager review
Checked Oct 16, 2026
Pick Google Secret Manager when
You want the lowest cost and IAM per secret inside Google Cloud.
Pick Infisical when
You want rotation for many databases and APIs, dynamic secrets and a self-hostable core.
From our Infisical review
Checked Oct 16, 2026
Pick Infisical when
Your apps span several clouds and hosting platforms and you want syncs and environments in one UI.
Pick AWS Secrets Manager when
Your workloads are on AWS and you want $85 a month for the scenario, with ISO 27001 and FedRAMP.

Entry price

Baseline: each product's cheapest paid plan, per month. Included usage differs, so read the line under each price.

AWS Secrets Manager
Pay as you go
$0.40/secret/mo
Plus $0.05 per 10,000 API calls; prorated by the hour; replicas billed as secrets
- Managed rotation for RDS, Aurora, DocumentDB and Redshift
- New versions free; AWS managed KMS key free
- No charge for secrets scheduled for deletion
- Volume pricing through AWS sales
Google Secret Manager
Pay as you go
$0.06/version/mo
Per active version per location; $0.03 per 10,000 access operations; $0.05 per rotation notification
- Management operations free; destroyed versions free
- Automatic replication billed as one location
- CMEK through Cloud KMS
- Custom quote on request
Infisical
Pro
$20/identity/mo
Billed annually; $23 billed monthly; 30-day trial, no card
- SAML SSO and folder-level access control
- Point-in-time recovery and IP allowlisting
- Rotation for public databases; 25 syncs, 6 environments
- 30 days of audit logs

Prices as listed on each pricing page, in USD per month, excluding tax. Observed: AWS Secrets Manager 2026-10-16, Google Secret Manager 2026-10-16, Infisical 2026-10-16.

Which one fits

If you need to start today without a sales call: Google Secret ManagerSelf-serve sign-up; the highest score of the 3 self-serve products here (8.5/10).
If you want to try it without entering a card: InfisicalFree plan, no card needed; scored 6.8/10.
Lowest starter price: Google Secret Manager$0.06/secret version/mo for the Pay as you go (plus $0.03 per 10,000 access operations) plan.
Highest overall score: Google Secret Manager8.5/10 (Excellent). The review shows the score breakdown and the run behind it.

Picked by fixed rules from the table above, not by hand. How we score

Full reviews

Add a product

Search by product name or by what it does, such as “email” or “feature flags”. 1 more fits in this comparison.