AWS Secrets Manager Cost Calculator

Separate steady inventory from bursty secret reads

Secrets Manager has two different cost shapes. Secret-month charges are the steady baseline. API reads are the bursty line item that changes when applications start faster, redeploy more often, or fetch secrets too frequently.

• Count active secrets by environment, not just by repository or service name.
• Estimate how often each workload fetches a secret at startup, on refresh, and during failures.
• Keep rotation workflows and downstream Lambda work outside this page unless you model them explicitly.

Where expensive behavior usually hides

• Per-request fetching: applications that call GetSecretValue on every request can explode API volume.
• Startup storms: autoscaling, rolling deployments, and short-lived jobs create clustered read bursts.
• Cache misses: local cache eviction, low TTLs, and retry loops can multiply read volume silently.
• Environment sprawl: duplicated secrets across prod, staging, and ephemeral environments raise the baseline.

How to reconcile the model with real behavior

1. Check the number of billed secret-months against the secrets you actually keep active.
2. Compare estimated API reads with deploy frequency, pod churn, and request-time fetch patterns.
3. Look for workloads that should cache in memory but still read secrets on every invocation.
4. Build a second scenario for deploy or incident months instead of treating startup bursts as noise.

What this page should hand off to next

If the API-call side dominates, the next review belongs with application caching and startup behavior. If the secret-month side dominates, review inventory discipline and whether some secrets belong in a cheaper config path. If both are small but the total bill is still high, inspect rotation, Lambda helpers, and adjacent platform costs.

Next steps