Google Secret Manager review
by Google CloudSecrets management
Pay-per-use secret storage in Google Cloud at $0.06 per active version, with a permanent free tier, IAM per secret and Google Cloud’s compliance scope.
- Free plan
- Self-serve
- Usage-based
- Public prices
What you're paying for
- Worth the price (main value)
- Compliance included
A pay-per-use secret store inside Google Cloud with a permanent free tier, IAM per secret and Google Cloud’s compliance coverage.
Google Secret Manager charges $0.06 per active secret version a month and $0.03 per 10,000 access operations, after a permanent monthly free tier of 6 versions and 10,000 accesses. Secrets get IAM bindings per secret, versions you can roll back to, CMEK keys in Cloud KMS and location control with regional secrets. It is in scope for SOC 2, ISO 27001, PCI DSS, FedRAMP and HIPAA, and Cloud Run, GKE, Cloud Build and GitHub Actions read secrets natively.
- Low cost for a small team200 secrets and 1,000,000 reads come to $14.61 a month: 194 versions above the free 6 at $0.06 and 99 × 10,000 accesses above the free 10,000 at $0.03 (computed).Evidence: Pricing page, monthly tab (2026-10-16)
- Covered by Google Cloud’s auditsSecret Manager is in scope for SOC 1, 2 and 3, ISO 27001, 27017 and 27018 and PCI DSS; the Google Cloud BAA covers it with no plan gating, and FedRAMP Moderate and High are listed.Evidence: Services in scope, HIPAA and Secret Manager compliance pages (2026-10-16)
- Built into Google Cloud runtimesCloud Run, Cloud Run functions, Cloud Build, Compute Engine and GKE read secrets natively; the GKE add-on mounts them through the Secrets Store CSI Driver.Evidence: Docs: using Secret Manager with other products; GKE add-on (2026-10-16)
- Best for
- Teams on Google Cloud that want a low-cost secret store under the IAM, KMS and audit logging they already use.
- Good to know
- Rotation mostly sends notifications for your own code to act on, and there are no dynamic secrets or push syncs to other platforms.
How Google Secret Manager compares
Against 3 other products we reviewed in Secrets management: what you pay for with each, the five access facts, the plan limits we recorded and each review's bottom line. The note under the table says how each one was checked.
| Metric | Google Secret Manager | Doppler | AWS Secrets Manager | Infisical |
|---|---|---|---|---|
| What you're paying for | Worth the priceA pay-per-use secret store inside Google Cloud with a permanent free tier, IAM per secret and Google Cloud’s compliance coverage. | Saves engineering timeOne place to store, sync and rotate app secrets across environments, billed per engineer with machine identities free. | Compliance includedSecrets stored and rotated inside your AWS account, under AWS’s compliance programs, IAM controls and CloudTrail audit trail. | Saves engineering timeAn open-source secrets platform with syncs, rotation and dynamic secrets that you can use in its cloud or run yourself. |
| Overall score | 8.5Best | 7.3 | 7.0 | 6.8 |
| Free option | Free plan | Free plan | Free trial | Free plan |
| Card to start | –Not measured | No card needed | –Not measured | No card needed |
| Getting access | Self-serve | Self-serve | Self-serve | Self-serve |
| Starter priceCheapest paid plan | $0.06/secret version/mo | $21/user/mo | $0.40/secret/mo | $20/identity/mo |
| Pricing model | Usage-based | Per seat | Usage-based | Per seat |
| Pricing page | Public prices | Public prices | Public prices | Public prices |
| Billing unit | Per active secret version per location and per 10,000 access operations | Per human user per month; no secret, API or usage fees | Per secret per month and per 10,000 API calls | Per identity (human or machine) per month |
| Free option | Permanent free tier: 6 versions, 10,000 accesses, 3 rotation notifications a month | Developer: 3 users free, $8 per additional user up to 25; 14-day Team trial, no card | No free tier of its own; up to $200 of AWS Free Tier credit for new accounts | Free: 5 identities, 10 syncs; 30-day trial of paid plans, no card |
| Reference scenario (monthly) | $14.61 (194 × $0.06 + 99 × $0.03), computed | $210 on Team (10 × $21), computed | $85 (200 × $0.40 + 100 × $0.05), computed | $300 on Pro (15 × $20, annual), computed |
| Machine identities | Service accounts and IAM principals, not billed | Free; service accounts from Team | IAM roles and users, not billed | Billed like users; machines with identical permissions can share one |
| Audit log retention | Secret reads: 30 days once Data Access logs are on; admin activity 400 days | 3 days on Developer, 90 days on Team, custom on Enterprise | CloudTrail event history, 90 days; trails to S3 for longer | None on Free, 30 days on Pro, 90 on Advanced, custom on Enterprise |
| Dynamic secrets | Not offered | Enterprise (AWS IAM, Azure Service Principal) | Not offered | Advanced ($40 per identity) |
| Database rotation | Managed Cloud SQL rotation in Preview (regional secrets); Pub/Sub notifications otherwise | Team for GCP Cloud SQL via API; proxied AWS databases on Enterprise | Managed rotation for RDS, Aurora, DocumentDB and Redshift | Pro for public databases; full rotation on Advanced |
| Kubernetes | Secret Manager add-on for GKE (CSI driver), sync to Kubernetes Secrets | Doppler Kubernetes Operator and External Secrets provider, all plans | Secrets Store CSI provider (ASCP), EKS add-on | Operator, Agent Injector and CSI provider; External Secrets provider |
| SAML SSO / SCIM | Through Cloud Identity Free; Entra ID provisioning guide | SAML on Team; SCIM on Enterprise | IAM Identity Center, no extra charge | SAML on Pro; SCIM on Enterprise |
| SOC 2 / ISO 27001 | SOC 1, 2, 3; ISO 27001, 27017, 27018 | SOC 2 Type II; ISO 27001 | SOC 1, 2, 3; ISO 27001, 27017, 27018 | SOC 2 Type II; no ISO 27001 stated |
| HIPAA BAA | Covered by the Google Cloud BAA, every account | Not described | HIPAA-eligible under a BAA with AWS | HIPAA compliance stated; BAA by agreement, plan not stated |
| EU data storage | Regional secrets or user-managed replication in EU locations | No EU region; GCP us-central1 | Any EU region you choose | EU cloud region (eu.infisical.com) |
| Self-hosting | Not offered | Doppler On-prem, Enterprise only | Not offered | MIT-licensed core free; enterprise features need a license |
| Secret export | One version at a time | CLI and API download as JSON, .env or YAML | One secret, or up to 20 per batch call | CLI export as dotenv, CSV, JSON or YAML |
| Bottom line | From its public pages, Google Secret Manager is the lowest-cost option here, at $14.61 a month for our scenario, with a permanent free tier and Google Cloud’s compliance coverage. Rotation is mostly yours to build, and there are no dynamic secrets or push syncs. | From its public pages, Doppler is a simple seat-priced secrets platform: machine identities are free, and Team at $21 a user adds SSO, rotation and 90-day logs. Dynamic secrets, SCIM, SIEM forwarding and customer-managed keys need Enterprise, and the cloud runs in the US only. | From its public pages, AWS Secrets Manager is a low-cost, widely certified secrets store for AWS workloads, at $85 a month for our scenario with native database rotation. It has no free tier of its own, no dynamic secrets and no push syncs beyond AWS. | From its public pages, Infisical pairs broad rotation, syncs and dynamic secrets on self-serve plans with an MIT core to self-host and an EU region. Every identity is billed, audit logs start on Pro with 30 days, and SCIM and SIEM streaming need Enterprise. |
Evidence: Google Secret Manager: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Doppler: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; AWS Secrets Manager: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run; Infisical: facts checked 2026-10-16 from its public sign-up and pricing pages, no completed hands-on run. Prices in USD as listed, excluding tax. "–" means not recorded.
Score
- Pricing clarity
- 8.0 / 10, Excellent
- scenario plan priced; can be bought online; month-to-month or pay-as-you-go price published; usage past the limits priced; the pricing table labels the free-version tiers "0 month to 6 month" and "6 month and above" where versions are meant; the pricing example takes 3 free rotation notifications off each secret, while the free tier gives 3 per billing account a month
- Free tier and trial
- 8.5 / 10, Excellent
- free tier: 6 active secret versions, 10,000 access operations and 3 rotation notifications a month per billing account, all features; no per-user limit; up to 6 secrets; audit log through Cloud Audit Logs; sync or CI integration included; $300 of Google Cloud credit for new customers over 90 days (not scored)
- Price for the reference scenario
- 9.3 / 10, Excellent
- $14.61/mo on pay as you go, billed monthly: 194 active secret versions beyond the 6 free × $0.06 + 99 blocks of 10,000 access operations beyond the 10,000 free × $0.03; one version per secret with automatic replication, billed as one location; management operations free; secret reads are logged once Data Access audit logs are turned on and kept 30 days in the _Default bucket, with Cloud Logging at $0.50 per GiB beyond 50 GiB per project a month; assumes the Data Access log entries for 1,000,000 reads fit in Cloud Logging’s free 50 GiB a month (entry size not stated)
- Secret lifecycle and delivery
- 8.0 / 10, Excellent
- database rotation on the scenario plan; dynamic secrets not listed; versioning with rollback on the scenario plan; CI/CD and hosting syncs on the scenario plan; Kubernetes delivery on the scenario plan; managed Cloud SQL rotation is in Preview for regional secrets; global secrets get rotation notifications only
- Compliance and trust
- 10.0 / 10, Excellent
- SOC 2 Type II (in Google Cloud’s SOC 2 Type II scope); ISO 27001; HIPAA BAA on the scenario plan; EU data storage on the scenario plan (regional secrets or user-managed replication in EU locations); FIPS crypto or customer-managed keys on the scenario plan (CMEK in Cloud KMS, including Cloud EKM; FIPS 140-validated modules at rest)
- Access control and exit
- 7.3 / 10, Good
- SAML SSO on the scenario plan; SCIM on the scenario plan; 30-day audit log on the scenario plan; SIEM streaming on the scenario plan; per-environment or custom roles on the scenario plan; no bulk export (one version at a time through gcloud or the API); no self-hosted option
Review
Review from public pages
Written from Google Secret Manager's public pages (pricing, security or privacy, and docs) as read on Oct 16, 2026. We did not sign up, and no hands-on run is published yet.
What the public pages show
We read Google Secret Manager's pricing page with its hourly and monthly tabs, the product page, the docs on versions, replication, regional secrets, rotation, managed Cloud SQL rotation, CMEK, audit logging, quotas, best practices, other Google products and the GKE add-on, Cloud Logging pricing and quotas, the Cloud Identity editions page, Google's federation guide for Microsoft Entra ID, the compliance, HIPAA and FIPS pages, and the Google Cloud terms and data processing addendum on Oct 16, 2026; we did not sign up or call the API. Every page served US English with US dollar prices.
Billing is per active secret version per location and per 10,000 access operations, with a permanent monthly free tier. Management operations are free; disabled versions still count as active until destroyed. Secret reads are recorded only once Data Access audit logs are turned on, and the default log bucket keeps them 30 days.
A few points need a question to Google. The pricing table labels its free-version tiers in months rather than versions. Its rotation example subtracts 3 free notifications per secret, while the free tier gives 3 per billing account. Global secrets get rotation notifications only, and managed Cloud SQL rotation is in Preview for regional secrets.
Strengths
- A permanent free tier
6 active secret versions, 10,000 access operations and 3 rotation notifications every month, per billing account, during and after the free trial.
vs AWS Secrets Manager: AWS Secrets Manager offers only Free Tier credit for new AWS accounts.
- Lowest cost for our scenario
$14.61 a month for 200 secrets and 1,000,000 reads (computed), with no per-user or per-identity fee.
vs AWS Secrets Manager: AWS Secrets Manager comes to $85 and Doppler Team to $210.
- Compliance with no plan gate
SOC 2, ISO 27001, 27017 and 27018, PCI DSS, FedRAMP Moderate and High and a HIPAA BAA, offered to every account at the same price.
- Control over keys and location
CMEK keys in Cloud KMS, including Cloud EKM external keys, and regional secrets that keep data in one location.
Things to know
- Rotation mostly runs through your own code
Global secrets get rotation notifications on Pub/Sub for your own code to act on; managed rotation is in Preview for regional Cloud SQL PostgreSQL and SQL Server secrets.
- No dynamic secrets or push syncs
There is no dynamic secret engine and no push sync to GitLab, Vercel, Netlify or other clouds; GitHub Actions and Google runtimes pull secrets.
- Secret reads are not logged by default
Data Access audit logs, which record secret reads, are off by default; once on, the default bucket keeps 30 days, and Cloud Logging bills $0.50 per GiB beyond 50 GiB per project a month.
Workaround: Turn on Data Access logs for Secret Manager and route them to a longer-retention bucket or a SIEM through a log sink.
- Export one version at a time
The CLI and API read one secret version at a time; there is no bulk or .env export, and disabled versions keep billing until destroyed.
Pricing reality
Secret Manager bills $0.06 per active secret version per location a month and $0.03 per 10,000 access operations, after 6 free versions and 10,000 free accesses per billing account each month. For our scenario, 194 × $0.06 = $11.64 and 99 × $0.03 = $2.97, $14.61 a month in all (computed), with one version per secret and automatic replication, billed as one location. Older versions left enabled or disabled are billed too; destroyed versions are free. Rotation notifications are $0.05 each after 3 free. Adjacent costs: Cloud KMS for CMEK keys, Pub/Sub and your own rotation code, and Cloud Logging for Data Access logs beyond 50 GiB a month. The $300 new-customer credit is left out.
Exit path
Secrets are read one version at a time through gcloud or the API, which returns base64 payloads; there is no bulk export or migration tool. Cloud Asset Inventory exports secret metadata to BigQuery. Destroying a version is permanent unless delayed destruction is set, and a deleted secret is removed at once. The Cloud terms let you stop using the service at any time.
Compared with
- Pick Google Secret Manager when
- You run on Google Cloud and want a permanent free tier and $14.61 a month for the scenario.
- Pick AWS Secrets Manager when
- You run on AWS and want managed rotation for RDS, Aurora, Redshift and DocumentDB.
- Pick Google Secret Manager when
- You want per-use pricing with no seat fees and Google Cloud’s compliance coverage.
- Pick Doppler when
- You want push syncs to CI and hosting platforms and one UI for environments across clouds.
- Pick Google Secret Manager when
- You want the lowest cost and IAM per secret inside Google Cloud.
- Pick Infisical when
- You want rotation for many databases and APIs, dynamic secrets and a self-hostable core.
Choose it if
- Your apps run on Cloud Run, GKE or Cloud Build.
- You want a permanent free tier and low per-use pricing.
- You need HIPAA, PCI DSS or FedRAMP coverage without a plan upgrade.
Look elsewhere if
- You need managed rotation or dynamic secrets out of the box.
- Your apps live outside Google Cloud and need push syncs.
- You want a bulk .env export.
Bottom line
From its public pages, Google Secret Manager is the lowest-cost option here, at $14.61 a month for our scenario, with a permanent free tier and Google Cloud’s compliance coverage. Rotation is mostly yours to build, and there are no dynamic secrets or push syncs.
Plan limits at a glance
| Limit | As recorded |
|---|---|
| Billing unit | Per active secret version per location and per 10,000 access operations |
| Free option | Permanent free tier: 6 versions, 10,000 accesses, 3 rotation notifications a month |
| Reference scenario (monthly) | $14.61 (194 × $0.06 + 99 × $0.03), computed |
| Machine identities | Service accounts and IAM principals, not billed |
| Audit log retention | Secret reads: 30 days once Data Access logs are on; admin activity 400 days |
| Dynamic secrets | Not offered |
| Database rotation | Managed Cloud SQL rotation in Preview (regional secrets); Pub/Sub notifications otherwise |
| Kubernetes | Secret Manager add-on for GKE (CSI driver), sync to Kubernetes Secrets |
| SAML SSO / SCIM | Through Cloud Identity Free; Entra ID provisioning guide |
| SOC 2 / ISO 27001 | SOC 1, 2, 3; ISO 27001, 27017, 27018 |
| HIPAA BAA | Covered by the Google Cloud BAA, every account |
| EU data storage | Regional secrets or user-managed replication in EU locations |
| Self-hosting | Not offered |
| Secret export | One version at a time |
Read from the vendor's public pages on Oct 16, 2026. No hands-on run is published yet. How we check
We have not published a sign-up run for Google Secret Manager yet. The access facts above were read from its sign-up and pricing pages on Oct 16, 2026.
We have not published API calls for Google Secret Manager yet.
Google Secret Manager lists 2 plans. The cheapest paid plan, Pay as you go (plus $0.03 per 10,000 access operations), costs $0.06/secret version/mo.
- Google Secret ManagerFreeFree tier$0/moEvery month, per billing account, during and after the free trial
- 6 active secret versions
- 10,000 access operations
- 3 rotation notifications
- All features
- Google Secret ManagerPay as you go$0.06/version/moPer active version per location; $0.03 per 10,000 access operations; $0.05 per rotation notification
- Management operations free; destroyed versions free
- Automatic replication billed as one location
- CMEK through Cloud KMS
- Custom quote on request
Prices as listed, USD, excluding tax; observed 2026-10-16.
Source: cloud.google.com pricing page. Prices change; the observed date above is when our agent read them.