AWSSecretsManager-Secrets - $0.40 per secret per month

What it costs

US East (N. Virginia); other regions differ. Checked 2026-11-05. Sources: AWS Secrets Manager pricing, AWS price list file, Secrets Manager offer, us-east-1.

Example with made-up numbers

Typical causes

One secret per value

Database user, password and host stored as three secrets cost $1.20 where one JSON secret costs $0.40.

Secrets per environment and per developer

Every preview or test stack that creates its own secrets multiplies the count.

Secrets for retired services

Deleting a service rarely deletes its secrets.

Replicas in other regions

Each replicated secret bills again in the replica region.

Find it in your bill

Have a CUR file queryable in Athena? Paste this and run it:

SELECT date_trunc('month', line_item_usage_start_date) AS month,
       line_item_product_code,
       line_item_usage_type,
       line_item_resource_id,
       SUM(line_item_usage_amount)  AS usage_amount,
       SUM(line_item_unblended_cost) AS cost
FROM your_cur_table
WHERE line_item_usage_type LIKE '%AWSSecretsManager-Secrets'
GROUP BY 1, 2, 3, 4
ORDER BY month DESC, cost DESC
LIMIT 50;

Columns used: line_item_usage_start_date, line_item_product_code, line_item_usage_type, line_item_resource_id, line_item_usage_amount, line_item_unblended_cost.

No CUR file? Use Cost Explorer

1. Open Billing and Cost Management, then Cost Explorer, and set the date range to the last 3 months with Monthly granularity.
2. Set Group by to Usage type.
3. In the Filters panel choose Usage type and tick the entries ending in AWSSecretsManager-Secrets (the region prefix, such as USE1-, differs by region).
4. Read the monthly cost per usage type. A line that grows faster than your traffic is the one to chase with the fix below.
5. To see which resource drives it, query the CUR above; resource IDs appear only if your CUR was set up with resource IDs included, otherwise the resource column is empty.

Column names checked against: docs.aws.amazon.com/cur/latest/userguide/Lineitem-columns.html, docs.aws.amazon.com/cur/latest/userguide/cur-ate-run.html.

The fix, step by step

Verify first

Check these before you change anything: the steps below are suggestions, and only you can see your own configuration.

• A secret with no recent Last accessed date may still be read by a yearly job or a disaster-recovery runbook; search code and infrastructure-as-code for its name before deleting.
• Use the recovery window: a secret scheduled for deletion can be restored until the window ends.
• Secrets replicated to other regions are billed there too; check replication before counting.
• Merging values into one secret needs an application change; do it service by service.

In the console

1. Secrets Manager console > Secrets; sort by Last accessed date.
2. Open any secret whose Last accessed is old or empty and check which service or app used it.
3. For secrets still needed, see whether several values for the same app can live in one secret as a JSON document.
4. Delete secrets nobody uses: Actions > Delete secret, with a recovery window of 7 to 30 days.
5. For non-sensitive configuration, check whether Systems Manager Parameter Store fits instead (see the current pricing page for the free tier of standard parameters).

With the CLI

aws secretsmanager list-secrets --query 'SecretList[].[Name,LastAccessedDate,LastChangedDate]' --output table

aws secretsmanager delete-secret --secret-id EXAMPLE --recovery-window-in-days 30

aws secretsmanager restore-secret --secret-id EXAMPLE

Rollback

Restore a secret within its recovery window (restore-secret); after that it must be recreated from the original value.

Find your Secrets Manager line in your own bill

Drop in your Cost Explorer or CUR CSV. Billtrim reads it in your browser, finds the secrets line and shows how many secrets you pay for.

Get my ranked savings list See a sample result

Paste your export: how to export a Cost Explorer CSV or CUR file in two minutes.

Questions people ask

Does an unused secret still cost money?

Yes, $0.40 per month each, whether or not anything reads it.

Can I get the secret count from my bill?

Yes: the line cost divided by $0.40 is the number of secret-months, shown on the finding.

Related

• ConfigurationItemRecorded and ConfigRuleEvaluations - what AWS Config bills for
• CW:MetricMonitorUsage and CW:AlarmMonitorUsage - custom metrics and alarms
• VpcEndpoint-Hours: what interface endpoints cost

Part of the guide: Reduce your AWS bill as a startup: a checklist for teams with no FinOps person