Estimating AWS Secrets Manager Cost: A Worksheet

Build the estimate from five inputs and look up each rate yourself:

• Secrets stored: count every secret in every environment. Development, staging and production copies each count.
• API calls: each retrieval is a call. Multiply calls per service instance by instances by how often each one fetches.
• Rotation: automatic rotation runs a function you pay for separately, and rotation frequency changes how often it runs.
• Encryption keys: secrets are encrypted with a key. The default AWS-managed key is simplest; a customer-managed key in KMS adds its own monthly and request charges.
• Replication: replicating secrets to another region counts as additional stored secrets.

Write the formula in a spreadsheet: (secrets × monthly secret price) + (API calls ÷ 10,000 × price per 10,000 calls) + rotation and key costs.

Say the monthly price is $1 per secret and $0.10 per 10,000 calls. These are round placeholder figures for illustration only, not AWS's real rates, so swap in the current ones.

Suppose you run 20 services in three environments, and each service has 2 secrets per environment. In this example that's 120 secrets, or $120 a month at the placeholder rate. Now the calls. If each of 20 services runs 5 containers that fetch their secrets once at startup and restart 4 times a day in production, that's 400 calls a day, or about 12,000 a month, which is small. Suppose instead the code fetches the secret on every request and serves 10 million requests a month: that's 10 million calls, and at the placeholder rate about $100. The lesson is that call volume, not the number of secrets, usually explains surprises.

Levers, from easiest to most effort:

1. Cache retrieved values in memory for minutes or hours, and fetch at startup instead of per request.
2. Group related values into one secret as a JSON document, for example database host, user and password together, so you pay for one secret instead of three.
3. Delete secrets for retired services and unused environments. Tag secrets with an owner to make cleanup possible.
4. Store non-sensitive configuration in a cheaper parameter store instead of treating everything as a secret.
5. Use the default encryption key unless a compliance requirement demands your own.
6. Rotate only secrets that benefit from it, and check that the rotation function isn't running more often than needed.

Cost shouldn't override security. Caching is fine, but a cache with no expiry makes rotation ineffective, since running services keep the old value.

Pricing models differ. AWS charges by secret and by call. A tool such as Doppler typically prices by users or seats and offers features like syncing secrets across environments and services outside AWS. Which is cheaper depends on how many people and secrets you have, so run your own numbers and confirm current plans in a demo.

Beyond price, ask where your workloads run. If everything is on AWS and you use IAM roles heavily, the native service integrates directly. If you span providers or want developers to manage secrets through a friendlier interface, a dedicated tool may cost less in time. The full comparison is in Doppler vs AWS Secrets Manager for B2B SaaS and HashiCorp Vault vs AWS Secrets Manager vs Doppler.

Watch for these:

• Counting only production secrets and forgetting that each environment and each region adds to the total.
• Ignoring retry loops. A service that crashes and restarts repeatedly can generate a large number of fetches.
• Forgetting key costs when a customer-managed key is required.
• Overlooking rotation function invocations and logging costs in the same account.
• Optimizing this line item while a single leaked hard-coded credential costs far more.

Review the estimate against the actual bill after a month, and tag secrets so the cost explorer can attribute spend by team.