Secrets Manager pricing: what to model (secrets + API calls)

Secrets Manager bills are usually a simple shape: secret-months plus API requests. The surprise is almost always request-driven spend caused by application patterns (fetch-per-request, cold-start churn, retries). This page is a practical checklist to model the bill and keep it predictable.

What to include in the cost model

• Secret-month baseline: number of active secrets × months (split by prod vs non-prod).
• API calls/month: GetSecretValue and other operations (baseline + peak scenario).
• Runtime pattern: fetch-per-start vs fetch-per-request (the difference is huge).
• Churn: deployments, restarts, autoscaling, and serverless cold starts.
• Retry multiplier: transient failures can multiply calls during incidents.

Tool: Secrets Manager cost calculator

Step 1: inventory secrets (secret-months)

• Count secrets by environment (prod/stage/dev) and by account/region.
• Identify “secret sprawl” patterns: secret-per-service, secret-per-tenant, secret-per-env.
• Decide what should be a secret vs config (don’t store low-sensitivity config as secrets by default).

Step 2: estimate API calls/month (requests are the common driver)

Start by answering: what triggers a call in your system? For most teams, the main driver is GetSecretValue.

• Per-start fetch: calls ≈ process starts/month × secrets fetched per start
• Per-request fetch (avoid): calls scale with traffic, not with instance count
• Peak/incident: add a retry and restart multiplier (deploy storms and timeouts)

Workflow: estimate Secrets Manager API calls

Step 3: identify the spike patterns (where budgets blow up)

• Kubernetes pod churn: frequent restarts and rolling deploys multiply “per-start” fetches.
• Serverless cold starts: concurrency spikes can increase secret fetches quickly.
• Sidecars/init containers: multiple containers per pod each fetching the same secrets.
• Retry loops: timeouts cause repeated fetches (especially if secrets are fetched inside hot paths).
• Non-prod always-on: staging/dev running 730 hours/month still generates calls and baseline spend.

Step 4: optimize safely (reduce calls, not security)

• Cache at the right layer: fetch once per process start with a TTL, not per request.
• Reduce secret fan-out: consolidate related secrets when appropriate (one fetch instead of many).
• Fix timeouts: treat repeated secret fetch retries as an incident; they are a reliability and cost problem.
• Control non-prod: disable real sends/real fetches in dev, or reduce churn during CI.

Related: request-based pricing

How to validate the model (in one week)

• In billing, confirm whether request charges dominate secret-month baseline.
• Use CloudTrail to identify top callers and operations (GetSecretValue, DescribeSecret).
• Compare “calls per instance start” and “calls per 1M app requests” to catch bad patterns.
• Re-check deploy/incident windows; they often explain monthly spikes.

Related guides and tools

Sources

• AWS Secrets Manager pricing
• AWS Secrets Manager User Guide
• Retrieving secrets (API usage context)

Related guides

Related calculators

FAQ