Most write-ups on AWS KMS vs Secrets Manager stop at the unit prices: forty cents per secret, five cents per ten thousand calls, a dollar per key. Those numbers are correct and almost useless, because nobody pays a unit price. You pay for a number of secrets read at some rate, and the rate is what decides the bill. This post is for the backend or platform engineer who has to pick where application secrets live on AWS and wants the monthly total before choosing, not after.
Every rate below comes from the AWS Price List API for us-east-1, read on 11 November 2026. A small script then turns those rates into monthly bills for three secret counts and three read patterns, across four setups. The script and its raw output are printed in full, so you can rerun them when AWS changes a price. The line most comparisons leave out is also here: the KMS Decrypt request behind every encrypted read.
Prices read 2026-11-11
Region: US East (N. Virginia), on-demand, no free trial credits applied
AWS Price List offer files, us-east-1:
AWSSecretsManager published 2026-09-11T12:46:10Z
awskms published 2026-11-08T17:23:42Z
AWSSystemsManager published 2026-11-03T18:35:38Z
Month length: 730 hours (2,628,000 seconds)
Excluded: CloudTrail data events, cross-Region replicas, rotation Lambda costs, support plans
The vendor pages behind these files are Secrets Manager pricing, AWS KMS pricing and Systems Manager pricing. None of the three shows a last-updated date, so the offer file publication dates above are the honest timestamps.
The Short Answer
Parameter Store standard parameters are the cheapest home for secrets at every read rate a well-behaved application produces. Secrets Manager costs forty cents per secret per month before anyone reads anything, which is ten to a hundred times the rest of the bill for most teams. However, an application that fetches secrets on every request without a cache pays roughly the same two to three thousand dollars a month on all four setups, because at that point the request charges swamp everything else.
In short, the choice between them is mostly about features such as rotation and cross-account sharing, as long as you cache. Without a cache, the choice barely matters, because every option is expensive.
Where the Prices Came From
The AWS pricing pages render from the same offer files the Price List API serves. Reading the JSON directly avoids two problems: rate tables that load through JavaScript, and summaries that quietly round. This PowerShell pulls the Secrets Manager file and prints each rate:
# Downloads the us-east-1 offer file and prints usage type, unit, price and description
$s = 'AWSSecretsManager' # also run with 'awskms' and 'AWSSystemsManager'
$u = "https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/$s/current/us-east-1/index.json"
$j = Invoke-RestMethod -Uri $u
$j.publicationDate
foreach ($sku in $j.terms.OnDemand.PSObject.Properties) {
foreach ($t in $sku.Value.PSObject.Properties) {
foreach ($pd in $t.Value.priceDimensions.PSObject.Properties) {
$v = $pd.Value
'{0} | {1} | {2} | {3}' -f $j.products.($sku.Name).attributes.usagetype, $v.unit, $v.pricePerUnit.USD, $v.description
}
}
}
Secrets Manager and KMS Rates
The raw output for Secrets Manager and the symmetric KMS lines:
USE1-AWSSecretsManager-Secrets | Secrets | 0.4000000000 | $0.40 per Secret
USE1-AWSSecretsManagerAPIRequest | API Requests | 0.0000050000 | $0.05 per 10000 API Requests
us-east-1-KMS-Keys | Keys | 1.0000000000 | $1 per customer managed KMS key version in US East (N. Virginia)
us-east-1-KMS-Requests | Requests | 0.0000030000 | $0.03 per 10000 KMS requests in US East (N. Virginia)
Global-KMS-Requests | Requests | 0.0000000000 | $0.00 per request - Monthly Global Free Tier for KMS requests
The Global-KMS-Requests free tier covers the first 20,000 requests a month, counted across all Regions.
Parameter Store Rates
The Parameter Store lines come from the AWSSystemsManager file:
USE1-PS-Advanced-Param-Tier1 | Hour | 0.0000700000 | $0.05 per Advanced Parameter per Month in US East (N. Virginia)
USE1-PS-Param-Processed-Tier1 | API Request | 0.0000050000 | $0.05 per 10,000 Advanced Parameter API interaction_Standard throughput in US East (N. Virginia)
USE1-PS-Param-Processed-Tier2 | API Request | 0.0000050000 | $0.05 per 10,000 Parameter API Interaction_Higher throughput in US East (N. Virginia)
Notice that the advanced parameter is billed hourly. At $0.00007 an hour it comes to $0.0511 over 730 hours, slightly above the advertised five cents. The script uses the advertised $0.05, and the difference is under a cent per parameter.
AWS KMS vs Secrets Manager vs Parameter Store: What Each One Bills
These services meter different things, so the totals only make sense once the billing units are clear. The table is the featured answer to “what does each one charge for”.
| Secrets Manager | Parameter Store standard | Parameter Store advanced | KMS envelope (DIY) | |
|---|---|---|---|---|
| Storage fee | $0.40 per secret-month | none | $0.05 per parameter-month | $1 per customer managed key-month |
| API fee | $0.05 per 10,000 calls | none up to 40 TPS, then $0.05 per 10,000 on every call | $0.05 per 10,000 calls | none beyond KMS |
| KMS Decrypt per read | yes, per GetSecretValue | yes, direct Decrypt per read | yes, decrypts the data key | yes, per decrypt you make |
| Value size limit | 64 KB | 4 KB | 8 KB | yours to decide |
| Count limit | see quotas page | 10,000 per Region | 100,000 per Region | none |
| Rotation built in | yes | no | no | no |
The size and count limits come from the Secrets Manager quotas page and the Parameter Store tiers page. Beyond those limits, three details in the table drive almost every surprising bill.
The 40 TPS Cliff in Parameter Store
First, Parameter Store standard throughput is free but capped. The throughput documentation sets the default at 40 transactions per second, shared across GetParameter, GetParameters and GetParametersByPath. Raising it to higher throughput is a single account setting, and the pricing page is explicit that afterwards “your API interactions will be charged for standard and advanced parameters.” In other words, the free tier does not just stop at 40 TPS. It disappears for every call in the account and Region.
Every Encrypted Read Calls KMS
Second, encrypted reads hit KMS. According to the Parameter Store SecureString documentation, standard parameters “are encrypted and decrypted directly under the KMS key that you specify”. Advanced parameters use envelope encryption, and every read still decrypts the data key through KMS. Similarly, the Secrets Manager encryption page says it decrypts the value before returning it, with batch calls able to reuse a decrypted key.
Who Pays for KMS Requests on AWS Managed Keys?
Third, the AWS documentation is not consistent about who pays for those KMS calls when the key is AWS managed. The KMS pricing page states: “While you are not charged for creation and storage of AWS-managed keys, you will be charged on any API request made to AWS-managed keys.” By contrast, the Secrets Manager user guide says you can use aws/secretsmanager “to encrypt your secrets for free”. That wording could mean the key or the requests. This post therefore shows every total twice, with and without the KMS request line, rather than picking one reading.
The Three Workloads
A price comparison is only as honest as its workload assumptions, so here they are in full. Each one is a pattern seen in ordinary production services.
- Deploy-time reads. Every secret is read once per deploy, and the service deploys 30 times a month. This is the pattern for secrets injected into environment variables by a pipeline or an ECS task definition.
- Cached reads. Ten service instances each refresh every secret once an hour. One hour is the default refresh interval of the AWS Python caching library, which the caching documentation describes as “By default, the cache refreshes secrets every hour.”
- Uncached reads. The application serves 50 requests per second and fetches three secrets on every request, with no cache at all. That is 150 reads per second, no matter how many secrets exist.
The fourth setup, KMS envelope encryption done by hand, assumes the ciphertext ships with the deployment, for example in a config file. As a result, the only charges are the key itself and one Decrypt call per read.
The Cost Script
The calculator is a single awk program, so it runs in any Bash, including Git Bash on Windows, with no installs. All rates sit at the top and carry the offer file they came from:
#!/usr/bin/env bash
# secrets-cost.sh: monthly cost of storing and reading secrets on AWS, us-east-1.
# Rates from the AWS Price List API (us-east-1 offer files) read 2026-11-11.
awk 'BEGIN {
SM_SECRET = 0.40; SM_API = 0.000005; # Secrets Manager
KMS_KEY = 1.00; KMS_REQ = 0.000003; KMS_FREE = 20000; # KMS
PS_ADV = 0.05; PS_API = 0.000005; PS_STD_TPS = 40; # Parameter Store
SECS = 2628000; # 730-hour month
printf "%-9s %5s %13s | %10s %10s | %10s %10s | %10s %10s | %10s\n", "workload", "n",
"reads/month", "SM", "SM+KMS", "PS-std", "PS-std+KMS", "PS-adv", "PS-adv+KMS", "DIY-CMK"
split("10 100 1000", NS, " "); split("deploy cached uncached", WL, " ")
for (w = 1; w <= 3; w++) for (i = 1; i <= 3; i++) {
n = NS[i]; wl = WL[w]
if (wl == "deploy") reads = n * 30 # 30 deploys a month
if (wl == "cached") reads = n * 10 * 730 # 10 instances, hourly refresh
if (wl == "uncached") reads = 50 * 3 * SECS # 50 req/s, 3 secrets each
tps = reads / SECS
kms = (reads > KMS_FREE ? reads - KMS_FREE : 0) * KMS_REQ # one Decrypt per read
sm = n * SM_SECRET + reads * SM_API
ps = (tps > PS_STD_TPS ? reads * PS_API : 0) # higher throughput bills every call
adv = n * PS_ADV + reads * PS_API
diy = KMS_KEY + kms
printf "%-9s %5d %13d | %10.2f %10.2f | %10.2f %10.2f | %10.2f %10.2f | %10.2f\n",
wl, n, reads, sm, sm + kms, ps, ps + kms, adv, adv + kms, diy
}
printf "\nUncached read rate: %.1f per second (standard Parameter Store limit: %d)\n",
50 * 3, PS_STD_TPS
printf "Secrets Manager: API cost equals the secret fee at %.0f reads per secret per month (%.1f per hour)\n",
SM_SECRET / SM_API, SM_SECRET / SM_API / 730
printf "Same break-even with the KMS Decrypt line counted: %.0f reads per secret per month (%.1f per hour)\n",
SM_SECRET / (SM_API + KMS_REQ), SM_SECRET / (SM_API + KMS_REQ) / 730
}'
Because every rate is a named constant, a price change means editing one line and rerunning. Moreover, the workload formulas are plain enough to swap in your own deploy count or instance count.
Raw Output of the Cost Script
The output below is pasted unedited:
workload n reads/month | SM SM+KMS | PS-std PS-std+KMS | PS-adv PS-adv+KMS | DIY-CMK
deploy 10 300 | 4.00 4.00 | 0.00 0.00 | 0.50 0.50 | 1.00
deploy 100 3000 | 40.02 40.02 | 0.00 0.00 | 5.01 5.01 | 1.00
deploy 1000 30000 | 400.15 400.18 | 0.00 0.03 | 50.15 50.18 | 1.03
cached 10 73000 | 4.37 4.52 | 0.00 0.16 | 0.86 1.02 | 1.16
cached 100 730000 | 43.65 45.78 | 0.00 2.13 | 8.65 10.78 | 3.13
cached 1000 7300000 | 436.50 458.34 | 0.00 21.84 | 86.50 108.34 | 22.84
uncached 10 394200000 | 1975.00 3157.54 | 1971.00 3153.54 | 1971.50 3154.04 | 1183.54
uncached 100 394200000 | 2011.00 3193.54 | 1971.00 3153.54 | 1976.00 3158.54 | 1183.54
uncached 1000 394200000 | 2371.00 3553.54 | 1971.00 3153.54 | 2021.00 3203.54 | 1183.54
Uncached read rate: 150.0 per second (standard Parameter Store limit: 40)
Secrets Manager: API cost equals the secret fee at 80000 reads per secret per month (109.6 per hour)
Same break-even with the KMS Decrypt line counted: 50000 reads per secret per month (68.5 per hour)
Monthly Cost for 100 Secrets
One hundred secrets is a realistic count for a small product with a handful of services, each holding database credentials, API keys and signing keys. In US dollars per month, with the KMS line included:
| Read pattern | Secrets Manager | Parameter Store standard | Parameter Store advanced | KMS envelope |
|---|---|---|---|---|
| Deploy-time (3,000 reads) | 40.02 | 0.00 | 5.01 | 1.00 |
| Cached hourly (730,000 reads) | 45.78 | 2.13 | 10.78 | 3.13 |
| Uncached (394.2M reads) | 3,193.54 | 3,153.54 | 3,158.54 | 1,183.54 |
For deploy-time and cached reads, the Secrets Manager bill is almost entirely the storage fee. Specifically, the cached row spends $40.00 on storage and $5.78 on reads. Parameter Store standard, meanwhile, costs nothing to store, and its only charge is the KMS Decrypt line, which is also the part AWS documents least clearly.
The uncached row is the real surprise. At 150 reads per second the application crosses the 40 TPS standard limit, so Parameter Store has to move to higher throughput. Once it does, every call costs the same five cents per ten thousand as Secrets Manager. Consequently, the three managed options land within $40 of each other. The hand-rolled KMS option is cheaper only because it skips the storage service’s API fee, and it still costs over a thousand dollars a month in Decrypt calls.
Monthly Cost for 10 and 1,000 Secrets
Scale changes the story only for Secrets Manager, because it is the one setup with a meaningful per-secret fee. Totals per month with the KMS line included:
| Setup | 10 secrets, cached | 1,000 secrets, deploy-time | 1,000 secrets, cached |
|---|---|---|---|
| Secrets Manager | 4.52 | 400.18 | 458.34 |
| Parameter Store standard | 0.16 | 0.03 | 21.84 |
| Parameter Store advanced | 1.02 | 50.18 | 108.34 |
| KMS envelope | 1.16 | 1.03 | 22.84 |
At a thousand secrets, Secrets Manager costs $400 a month before a single read. That is the figure to put in front of whoever approves the AWS budget, because it grows with the number of secrets, not with traffic. Parameter Store standard stays close to free until the read volume itself becomes large.
When Do API Calls Cost More Than Storage?
In Secrets Manager, API charges overtake the storage fee once a secret is read more than 80,000 times a month, or about 110 times an hour. With the KMS Decrypt line counted, the crossover falls to 50,000 reads a month, roughly 68 per hour. Below that rate, the forty-cent storage fee dominates the bill.
Put another way, a cache refreshing hourly across ten instances reads each secret 7,300 times a month, well under either line. Even a refresh every minute on a single instance, 43,800 reads a month, stays below the first break-even. Only an uncached hot path pushes a secret past it.
When to Use Secrets Manager
- You need managed rotation for RDS, Redshift or DocumentDB credentials and do not want to write the rotation Lambda yourself.
- Secrets must be shared across accounts through resource policies, or replicated to other Regions.
- Values exceed 8 KB, such as certificate bundles or large JSON documents.
- An auditor expects a dedicated secrets service with version stages, and forty cents per secret is a small price for an easier audit.
When NOT to Use Secrets Manager
- You store hundreds of static values such as feature toggles, endpoints or third-party API keys that never rotate. That is $0.40 each, every month, for no feature you use.
- The secrets only need to reach a container at deploy time. Parameter Store standard SecureString delivers the same encryption at no storage cost.
- A tight budget cannot absorb a bill that grows with every new microservice’s credentials.
Common Mistakes with Secrets Pricing on AWS
- Fetching secrets on every request. As the uncached rows show, this costs thousands a month on any setup. A cache with even a five-minute refresh removes almost all of it.
- Enabling Parameter Store higher throughput to fix one noisy service. The setting applies to the whole account and Region, so every previously free call starts billing at the same moment.
- Budgeting from unit prices and leaving out the KMS Decrypt line. On the cached 1,000 secret workload it is $21.84, the entire bill for Parameter Store standard.
- Treating the KMS free tier as per Region. The 20,000 free requests a month are counted across all Regions, so a multi-Region setup uses them up faster than expected.
- Choosing advanced parameters for size alone when values fit in 4 KB. Advanced costs $0.05 per parameter plus a charge on every call, even at standard throughput.
A Realistic Scenario: The Cache That Got Removed
Consider a small team running a dozen Lambda functions behind an API that serves a few hundred requests per second at peak. During a refactor, someone moves secret loading from the function’s init phase into the handler, perhaps to pick up rotated database passwords faster. Nothing breaks, and tests pass. As a result, every invocation now calls GetSecretValue three times.
The bill shows it weeks later. On this post’s uncached workload, 150 reads per second, the line comes to roughly $2,000 a month for Secrets Manager calls, plus about $1,180 if the KMS Decrypt requests are billed. The fix is to load once per container and refresh on a timer, as the Lambda patterns and pitfalls guide recommends for any per-invocation setup work. Rotation still works, because the cache refresh picks up the new version within its interval.
A Cached Secret Loader for Node.js
This Node.js loader keeps one value per container and refreshes it every five minutes:
import { SecretsManagerClient, GetSecretValueCommand } from '@aws-sdk/client-secrets-manager';
const client = new SecretsManagerClient({});
const REFRESH_MS = 5 * 60 * 1000; // five minutes: rotation lands quickly, calls stay rare
const cache = new Map(); // secretId -> { value, fetchedAt }
export async function getSecret(secretId) {
const hit = cache.get(secretId);
if (hit && Date.now() - hit.fetchedAt < REFRESH_MS) return hit.value;
try {
const res = await client.send(new GetSecretValueCommand({ SecretId: secretId }));
const value = JSON.parse(res.SecretString);
cache.set(secretId, { value, fetchedAt: Date.now() });
return value;
} catch (err) {
// Serve the stale value during a Secrets Manager outage instead of failing every request
if (hit) return hit.value;
throw err;
}
}
The stale fallback matters as much as the cache. Without it, a short API error during a refresh turns into failed requests across the fleet. With a five-minute refresh, a single container makes at most 8,760 calls a month per secret, comfortably under both break-even lines.
How This Fits With Your Wider Secrets Setup
Storage cost is only one axis. For the security side of the same choice, including HashiCorp Vault and where KMS fits as a building block rather than a store, see the comparison of Vault, AWS KMS and other secrets tools. Whichever store you pick, the IAM policy that grants secretsmanager:GetSecretValue or ssm:GetParameter decides who can read what, and the IAM roles and policies breakdown covers how to scope it per service.
Finally, a cheap secret store does not help if secrets end up in a Git repository. The guide on detecting and preventing leaked credentials covers the scanning side. For more line items worth auditing on the same bill, the AWS cost optimization tips apply the same habit of checking what each service actually meters.
Conclusion
On AWS KMS vs Secrets Manager vs Parameter Store, the totals are clearer than the unit prices suggest. Parameter Store standard SecureString is the cheapest store for any application that caches, and it stays near zero up to a thousand secrets. Secrets Manager earns its forty cents per secret only when you use rotation, cross-account sharing or large values. Without a cache, all four setups cost two to three thousand dollars a month at 150 reads per second.
Run the script with your own secret count and read rate before you pick. Then check how often each service fetches its secrets, because the cache decides the bill more than the store does. Prices were read on 11 November 2026 and move without notice, so rerun the numbers before quoting them.
