All Services

Security & IAM

AWS Secrets Manager

AWS Secrets Manager stores encrypted secret values and metadata, controls retrieval through IAM and resource policies, and supports scheduled or on-demand rotation with managed or Lambda-based workflows.

Explore pricing models, common use cases, infrastructure support, and the AWS services that commonly work with AWS Secrets Manager.

AWS Secrets Manager pricing and cost programs

Pricing model: Secret storage and API usage

On-Demand
Available
Reserved Instances or reserved capacity
Not applicable
Savings Plans
Not applicable
Spot
Not applicable

Billing dimensions: Secrets stored · API calls · Rotation integrations

Programs and modes: Secret storage · Automatic rotation · Cross-Region replication

Charges accrue per secret and per API request; rotation can invoke separately billed services.

Free Tier: Service-specific — verify current offers

Pricing reviewed 2026-07-25. Reviewed against the linked official AWS pricing page. Recheck regional rates and program terms before purchase.

Official AWS pricing

Official AWS sources reviewed 2026-07-21.

Why implement AWS Secrets Manager?

  • Removes plaintext credentials from source code, images, deployment templates, and ordinary configuration stores.
  • Centralizes access control, version staging, auditing, replication, and rotation for database credentials, API keys, tokens, and other secrets.
  • Integrates with AWS compute and database services and supports client-side caching to reduce latency and API cost.

How to implement AWS Secrets Manager

  1. Create the secret with a clear owner, schema, KMS key, tags, resource policy, recovery and rotation expectations; import the value through a protected channel rather than logs or shell history.
  2. Grant only the runtime identity permission to read the named secret and decrypt its key, use a VPC endpoint where required, and retrieve it with an AWS-supported cache rather than baking it into artifacts.
  3. Configure managed or Lambda rotation, test the full create-set-test-finish lifecycle and every consumer's refresh behavior, monitor CloudTrail and rotation failures, and rehearse emergency revocation.

AWS Secrets Manager best practices

  • Use BlockPublicPolicy and Access Analyzer when writing resource policies, keep administration separate from retrieval, and avoid wildcard secret and KMS access.
  • Cache secrets for bounded periods, never log values, prevent secrets from entering environment dumps or traces, and handle version stages and partial rotation failures safely.
  • Rotate according to risk and dependency capability, test consumers before enforcement, remove unused secrets, and use replicas only with a documented regional recovery plan.

AWS Secrets Manager use cases and server impact

  • Rotating database credentials
  • API tokens and third-party keys
  • Shared application secrets with audited retrieval

Replaces custom encrypted credential databases and rotation schedulers, while applications must retrieve, cache, refresh, redact, and recover from rotation correctly.

Official implementation resources

Commonly paired AWS services