AWS Secrets Manager review
by Amazon Web ServicesSecrets management
Pay-as-you-go secret storage in your AWS account at $0.40 per secret a month, with managed RDS rotation, KMS keys and AWS’s compliance programs.
- Free trial
- Self-serve
- Usage-based
- Public prices
What you're paying for
- Compliance included (main value)
- Worth the price
Secrets stored and rotated inside your AWS account, under AWS’s compliance programs, IAM controls and CloudTrail audit trail.
AWS Secrets Manager charges $0.40 per secret a month and $0.05 per 10,000 API calls, with no seats, tiers or minimums. It rotates Amazon RDS, Aurora, Redshift and DocumentDB credentials natively, encrypts with KMS keys you can manage yourself, and logs API calls to CloudTrail. It is in scope for SOC, ISO 27001, PCI DSS and FedRAMP and is HIPAA-eligible, so teams on AWS can add it under audits they already rely on.
- In scope for AWS’s auditsThe compliance doc lists ISO/IEC 27001, 27017, 27018 and 9001; the services-in-scope pages list SOC 1, 2 and 3, PCI DSS and FedRAMP; it is HIPAA-eligible under a BAA with AWS.Evidence: Secrets Manager compliance doc and AWS services-in-scope pages (2026-10-16)
- Managed database rotationManaged rotation covers Aurora, RDS, DocumentDB and Redshift, as often as every four hours, and managed external secrets cover partners such as Databricks, MongoDB Atlas and Snowflake.Evidence: FAQ and user guide: managed rotation and managed external secrets (2026-10-16)
- Pay per secret, not per personNo seats or tiers: $0.40 per secret a month and $0.05 per 10,000 API calls, no setup fees or commitments, and no charge for secrets scheduled for deletion.Evidence: Pricing page and AWS price file (2026-10-16)
- Best for
- Teams whose workloads run on AWS and want secrets under the same IAM, KMS and CloudTrail controls they already use.
- Good to know
- There are no dynamic secrets or push syncs to other platforms, and there is no free tier beyond credit for new AWS accounts.
How AWS Secrets Manager compares
Against 3 other products we reviewed in Secrets management: what you pay for with each, the five access facts, the plan limits we recorded and each review's bottom line. The note under the table says how each one was checked.
| Metric | AWS Secrets Manager | Google Secret Manager | Doppler | Infisical |
|---|---|---|---|---|
| What you're paying for | Compliance includedSecrets stored and rotated inside your AWS account, under AWS’s compliance programs, IAM controls and CloudTrail audit trail. | Worth the priceA pay-per-use secret store inside Google Cloud with a permanent free tier, IAM per secret and Google Cloud’s compliance coverage. | Saves engineering timeOne place to store, sync and rotate app secrets across environments, billed per engineer with machine identities free. | Saves engineering timeAn open-source secrets platform with syncs, rotation and dynamic secrets that you can use in its cloud or run yourself. |
| Overall score | 7.0 | 8.5Best | 7.3 | 6.8 |
| Free option | Free trial | Free plan | Free plan | Free plan |
| Card to start | –Not measured | –Not measured | No card needed | No card needed |
| Getting access | Self-serve | Self-serve | Self-serve | Self-serve |
| Starter priceCheapest paid plan | $0.40/secret/mo | $0.06/secret version/mo | $21/user/mo | $20/identity/mo |
| Pricing model | Usage-based | Usage-based | Per seat | Per seat |
| Pricing page | Public prices | Public prices | Public prices | Public prices |
| Billing unit | Per secret per month and per 10,000 API calls | Per active secret version per location and per 10,000 access operations | Per human user per month; no secret, API or usage fees | Per identity (human or machine) per month |
| Free option | No free tier of its own; up to $200 of AWS Free Tier credit for new accounts | Permanent free tier: 6 versions, 10,000 accesses, 3 rotation notifications a month | Developer: 3 users free, $8 per additional user up to 25; 14-day Team trial, no card | Free: 5 identities, 10 syncs; 30-day trial of paid plans, no card |
| Reference scenario (monthly) | $85 (200 × $0.40 + 100 × $0.05), computed | $14.61 (194 × $0.06 + 99 × $0.03), computed | $210 on Team (10 × $21), computed | $300 on Pro (15 × $20, annual), computed |
| Machine identities | IAM roles and users, not billed | Service accounts and IAM principals, not billed | Free; service accounts from Team | Billed like users; machines with identical permissions can share one |
| Audit log retention | CloudTrail event history, 90 days; trails to S3 for longer | Secret reads: 30 days once Data Access logs are on; admin activity 400 days | 3 days on Developer, 90 days on Team, custom on Enterprise | None on Free, 30 days on Pro, 90 on Advanced, custom on Enterprise |
| Dynamic secrets | Not offered | Not offered | Enterprise (AWS IAM, Azure Service Principal) | Advanced ($40 per identity) |
| Database rotation | Managed rotation for RDS, Aurora, DocumentDB and Redshift | Managed Cloud SQL rotation in Preview (regional secrets); Pub/Sub notifications otherwise | Team for GCP Cloud SQL via API; proxied AWS databases on Enterprise | Pro for public databases; full rotation on Advanced |
| Kubernetes | Secrets Store CSI provider (ASCP), EKS add-on | Secret Manager add-on for GKE (CSI driver), sync to Kubernetes Secrets | Doppler Kubernetes Operator and External Secrets provider, all plans | Operator, Agent Injector and CSI provider; External Secrets provider |
| SAML SSO / SCIM | IAM Identity Center, no extra charge | Through Cloud Identity Free; Entra ID provisioning guide | SAML on Team; SCIM on Enterprise | SAML on Pro; SCIM on Enterprise |
| SOC 2 / ISO 27001 | SOC 1, 2, 3; ISO 27001, 27017, 27018 | SOC 1, 2, 3; ISO 27001, 27017, 27018 | SOC 2 Type II; ISO 27001 | SOC 2 Type II; no ISO 27001 stated |
| HIPAA BAA | HIPAA-eligible under a BAA with AWS | Covered by the Google Cloud BAA, every account | Not described | HIPAA compliance stated; BAA by agreement, plan not stated |
| EU data storage | Any EU region you choose | Regional secrets or user-managed replication in EU locations | No EU region; GCP us-central1 | EU cloud region (eu.infisical.com) |
| Self-hosting | Not offered | Not offered | Doppler On-prem, Enterprise only | MIT-licensed core free; enterprise features need a license |
| Secret export | One secret, or up to 20 per batch call | One version at a time | CLI and API download as JSON, .env or YAML | CLI export as dotenv, CSV, JSON or YAML |
| Bottom line | From its public pages, AWS Secrets Manager is a low-cost, widely certified secrets store for AWS workloads, at $85 a month for our scenario with native database rotation. It has no free tier of its own, no dynamic secrets and no push syncs beyond AWS. | From its public pages, Google Secret Manager is the lowest-cost option here, at $14.61 a month for our scenario, with a permanent free tier and Google Cloud’s compliance coverage. Rotation is mostly yours to build, and there are no dynamic secrets or push syncs. | From its public pages, Doppler is a simple seat-priced secrets platform: machine identities are free, and Team at $21 a user adds SSO, rotation and 90-day logs. Dynamic secrets, SCIM, SIEM forwarding and customer-managed keys need Enterprise, and the cloud runs in the US only. | From its public pages, Infisical pairs broad rotation, syncs and dynamic secrets on self-serve plans with an MIT core to self-host and an EU region. Every identity is billed, audit logs start on Pro with 30 days, and SCIM and SIEM streaming need Enterprise. |
Evidence: AWS Secrets Manager: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Google Secret Manager: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Doppler: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Infisical: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run. Prices in USD as listed, excluding tax. "–" means not recorded.
Score
- Pricing clarity
- 9.0 / 10, Excellent
- scenario plan priced; can be bought online; month-to-month or pay-as-you-go price published; usage past the limits priced; the pricing page and FAQ say Free Tier credits must be used within 12 months; another Free Tier FAQ answer says they expire after 6 months
- Free tier and trial
- 0.0 / 10, Fair
- no permanent free tier or trial; up to $200 of AWS Free Tier credit for new accounts; the Free plan lasts up to 6 months (not scored)
- Price for the reference scenario
- 6.2 / 10, Good
- $85/mo on pay as you go, billed monthly: 200 secrets × $0.40 + 100 blocks of 10,000 API calls × $0.05; people and machines are IAM principals and are not billed; the AWS managed KMS key is free (a customer-managed key adds $1 a month and $0.03 per 10,000 requests); CloudTrail event history keeps 90 days of API calls at no charge
- Secret lifecycle and delivery
- 8.0 / 10, Excellent
- database rotation on the scenario plan; dynamic secrets not listed; versioning with rollback on the scenario plan; CI/CD and hosting syncs on the scenario plan; Kubernetes delivery on the scenario plan; GitHub Actions and Kubernetes pull secrets; no push sync to other platforms
- Compliance and trust
- 10.0 / 10, Excellent
- SOC 2 Type II (SOC 1, 2 and 3 in scope, reports in AWS Artifact); ISO 27001; HIPAA BAA on the scenario plan; EU data storage on the scenario plan (secrets stored in the region you choose); FIPS crypto or customer-managed keys on the scenario plan (customer-managed KMS keys, external key store or CloudHSM; FIPS endpoints)
- Access control and exit
- 9.0 / 10, Excellent
- SAML SSO on the scenario plan; SCIM on the scenario plan; 90-day audit log on the scenario plan; SIEM streaming on the scenario plan; per-environment or custom roles on the scenario plan; bulk export (BatchGetSecretValue returns up to 20 secrets per call, by list or filter); no self-hosted option
Review
Review from public pages
Written from AWS Secrets Manager's public pages (pricing, security or privacy, and docs) as read on Oct 16, 2026. We did not sign up, and no hands-on run is published yet.
What the public pages show
We read the AWS Secrets Manager pricing page (whose prices load from AWS's price file), its FAQ and features pages, the user guide on quotas, rotation, managed external secrets, GitHub Actions, Kubernetes, access control, versions, encryption, compliance, CloudTrail and deletion, the API reference, the AWS services-in-scope pages, the IAM Identity Center FAQ, KMS pricing, the Free Tier FAQ, the service terms and the customer agreement on Oct 16, 2026; we did not sign up or call the API.
The model is the simplest here: $0.40 per secret a month and $0.05 per 10,000 API calls, the same in every region, prorated by the hour, with no tiers or seats. New versions created by rotation are free, and the AWS managed KMS key costs nothing; a customer-managed key adds KMS fees. Access is controlled with IAM policies, and SSO and SCIM come through IAM Identity Center at no extra charge. CloudTrail records all Secrets Manager API calls, and its console shows the last 90 days.
A few points need a question to AWS. The pricing page and FAQ say Free Tier credits must be used within 12 months, while another Free Tier FAQ answer says they expire after 6 months. The compliance doc cites PCI DSS 3.2. Each replica region is billed as another secret. There is no built-in dynamic secret engine; the pricing page's example of generated tokens is a solution the customer builds.
Strengths
- Broad compliance coverage
SOC 1, 2 and 3, ISO 27001, 27017 and 27018, PCI DSS, FedRAMP and HIPAA eligibility, with audit reports downloaded through AWS Artifact.
vs Doppler: Doppler’s pages describe no HIPAA BAA, and HCP Vault Dedicated does not support one.
- Native database rotation
Managed rotation for RDS, Aurora, DocumentDB and Redshift, and Lambda-based rotation for other targets.
vs Google Secret Manager: Google Secret Manager’s managed rotation is in Preview for regional Cloud SQL secrets only.
- Your own keys and network rules
Secrets can be encrypted with customer-managed KMS keys, an external key store or CloudHSM, reached over VPC endpoints, and limited by source IP or VPC in IAM policies; FIPS endpoints are available.
- Low cost at small scale
200 secrets and 1,000,000 reads cost $85 a month (computed), with no per-user fee.
vs Doppler: Doppler’s Team plan comes to $210 a month for 10 engineers.
Things to know
- No dynamic secrets or push syncs
There is no built-in dynamic secret engine, and secrets are pulled by GitHub Actions, the Kubernetes CSI provider or SDKs rather than pushed to other platforms.
- Cost grows with the secret count
Each secret and each replica region is $0.40 a month; 2,000 secrets would cost $800 a month before API calls (computed).
Workaround: A secret can hold several values as JSON, up to 65,536 bytes, which the GitHub Action can split into variables.
- Export is one secret or 20 at a time
GetSecretValue returns one secret and BatchGetSecretValue up to 20 per call; there is no .env or YAML export and no importer from other vendors.
- No free tier of its own
The only free option is AWS Free Tier credit for new accounts, up to $200 over 6 months; an account not upgraded by then is suspended and later erased.
Pricing reality
Secrets Manager bills $0.40 per secret a month, prorated by the hour, and $0.05 per 10,000 API calls, with no seats, tiers or minimum. For our scenario, 200 secrets cost 200 × $0.40 = $80 and 1,000,000 reads cost 100 × $0.05 = $5, $85 a month in all (computed). People and machines are IAM principals and are not billed. Adjacent costs: a customer-managed KMS key adds $1 a month plus $0.03 per 10,000 requests; Lambda-based rotation pays Lambda rates; CloudTrail’s 90-day event history is free, while trails pay for S3 storage. Replicas in other regions are billed as separate secrets. Volume pricing is through AWS sales.
Exit path
Secrets are read through the CLI, SDKs or API, one at a time or up to 20 per BatchGetSecretValue call; there is no bulk file export or migration tool. A deleted secret can be restored for 7 to 30 days and is not billed in that window. After an AWS account is closed, content can be retrieved for 30 days.
Compared with
- Pick AWS Secrets Manager when
- Your workloads are on AWS and you want managed rotation for RDS, Aurora, Redshift and DocumentDB.
- Pick Google Secret Manager when
- You run on Google Cloud and want a permanent free tier and $14.61 a month for the scenario.
- Pick AWS Secrets Manager when
- You want AWS’s compliance programs and KMS keys at $85 a month for the scenario.
- Pick Doppler when
- You want push syncs to GitHub Actions, Vercel and other clouds, and environments for every project in one UI.
- Pick AWS Secrets Manager when
- You want one service per AWS account with IAM controls and no per-identity fee.
- Pick Infisical when
- You want dynamic secrets, syncs across clouds and an MIT core you can self-host.
Choose it if
- Your apps run on AWS and use IAM roles.
- You need HIPAA, PCI DSS or FedRAMP coverage for the secrets store.
- You rotate RDS, Aurora or Redshift credentials.
Look elsewhere if
- You need dynamic secrets or push syncs to other platforms.
- You keep thousands of secrets and want a flat per-seat price.
- You want a bulk .env export.
Bottom line
From its public pages, AWS Secrets Manager is a low-cost, widely certified secrets store for AWS workloads, at $85 a month for our scenario with native database rotation. It has no free tier of its own, no dynamic secrets and no push syncs beyond AWS.
Plan limits at a glance
| Limit | As recorded |
|---|---|
| Billing unit | Per secret per month and per 10,000 API calls |
| Free option | No free tier of its own; up to $200 of AWS Free Tier credit for new accounts |
| Reference scenario (monthly) | $85 (200 × $0.40 + 100 × $0.05), computed |
| Machine identities | IAM roles and users, not billed |
| Audit log retention | CloudTrail event history, 90 days; trails to S3 for longer |
| Dynamic secrets | Not offered |
| Database rotation | Managed rotation for RDS, Aurora, DocumentDB and Redshift |
| Kubernetes | Secrets Store CSI provider (ASCP), EKS add-on |
| SAML SSO / SCIM | IAM Identity Center, no extra charge |
| SOC 2 / ISO 27001 | SOC 1, 2, 3; ISO 27001, 27017, 27018 |
| HIPAA BAA | HIPAA-eligible under a BAA with AWS |
| EU data storage | Any EU region you choose |
| Self-hosting | Not offered |
| Secret export | One secret, or up to 20 per batch call |
Read from the vendor's public pages on Oct 16, 2026. No hands-on run is published yet. How we check
We have not published a sign-up run for AWS Secrets Manager yet. The access facts above were read from its sign-up and pricing pages on Oct 16, 2026.
We have not published API calls for AWS Secrets Manager yet.
AWS Secrets Manager lists 2 plans. The cheapest paid plan, Pay as you go (plus $0.05 per 10,000 API calls), costs $0.40/secret/mo.
- AWS Secrets ManagerFreeAWS Free Tier (Free plan)$0/moUp to $200 in credits for new AWS accounts; the Free plan lasts up to 6 months
- Credits apply across AWS services, including Secrets Manager
- Account is suspended when the Free plan ends unless upgraded
- AWS Secrets ManagerPay as you go$0.40/secret/moPlus $0.05 per 10,000 API calls; prorated by the hour; replicas billed as secrets
- Managed rotation for RDS, Aurora, DocumentDB and Redshift
- New versions free; AWS managed KMS key free
- No charge for secrets scheduled for deletion
- Volume pricing through AWS sales
Prices as listed, USD, excluding tax; observed 2026-10-16.
Source: aws.amazon.com pricing page. Prices change; the observed date above is when our agent read them.