- Home
- Secrets Management Tools
- AWS Secrets Manager
AWS Secrets Manager
What it is
AWS Secrets Manager manages credentials, API keys, and other secrets used by applications, services, and IT resources throughout their lifecycle. Secrets are encrypted at rest with AWS Key Management Service keys and sent over TLS when retrieved. AWS Identity and Access Management supports access controls through IAM and resource-based policies. Secrets can be rotated on a schedule or on demand through the console, AWS SDK, or AWS CLI, and replicated across AWS Regions with synchronized regional read replicas. Applications can retrieve individual secrets or groups by name, ARN, or tag filter; client-side caching libraries are also available. The service integrates with CloudTrail, CloudWatch, SNS, and EventBridge for auditing, monitoring, and notifications. AWS lists integrations with services such as RDS, Redshift, and CodeBuild, along with managed rotation for selected third-party services. It is a cloud service available through API and web. Pay-as-you-go pricing is $0.40 per secret per month and $0.05 per 10,000 API calls. AWS Free Tier credits are available under the listed time and expiration terms.
For and against
For
- Encrypts secrets at rest and in transit
- Supports scheduled and on-demand rotation
- Replicates secrets across AWS Regions
- Retrieves secrets by name, ARN, or tag
- Integrates with CloudTrail and CloudWatch
Against
- Costs $0.40 per secret per month
- API calls cost $0.05 per 10,000
- Customer-managed KMS keys incur separate charges
- Some automatic rotation incurs AWS Lambda charges
The verdict
AWS Secrets Manager brings secret storage, access control, rotation, retrieval, and monitoring integrations into a cloud service. Account for per-secret and API-call charges, along with possible KMS or Lambda costs.
Who it suits
AWS Secrets Manager suits IT and security administrators and developers managing application credentials and other secrets. It also fits teams that need scheduled or on-demand rotation, regional replication, or auditing integrations.
Plans and prices
AWS Free Tier
up to $200 in AWS Free Tier credits · free plan available 6 months after account creation · credits expire within 12 months of account creation
Read 30 Sep 2026 · aws.amazon.com
Pay-as-you-go
$0.40 per secret per month · $0.05 per 10,000 API calls · no upfront costs or long-term contracts
Read 30 Sep 2026 · aws.amazon.com
On the record
- Access control
- AWS Identity and Access Management provides fine-grained IAM and resource-based policies for controlling access to secrets.aws.amazon.com · read 30 Sep 2026
- API and documentation
- AWS publishes a Secrets Manager User Guide and API Reference, and recommends using AWS SDKs for API calls.docs.aws.amazon.com · read 30 Sep 2026
- Automatic rotation
- Secrets can be rotated on a schedule or on demand through the console, AWS SDK, or AWS CLI.aws.amazon.com · read 30 Sep 2026
- Compliance
- AWS lists support for compliance workloads involving DoD CC SRG IL2, IL4, and IL5, FedRAMP, HIPAA, IRAP, OSPAR, ISO 27001, ISO 27017, ISO 27018, ISO 9001, PCI-DSS, and SOC.aws.amazon.com · read 30 Sep 2026
- Encryption
- Secrets Manager encrypts secrets at rest with AWS Key Management Service keys and transmits retrieved secrets over TLS.aws.amazon.com · read 30 Sep 2026
- Integrations
- Listed AWS integrations include Amazon RDS, Amazon Redshift, Amazon DocumentDB, Amazon MSK, Amazon SageMaker, AWS CodeBuild, and AWS Transfer Family.aws.amazon.com · read 30 Sep 2026
- Managed external secrets
- Managed external secrets provides predefined partner formats and Lambda-free automatic rotation for third-party credentials.docs.aws.amazon.com · read 30 Sep 2026
- Monitoring
- Secrets Manager integrates with AWS CloudTrail, Amazon CloudWatch, Amazon SNS, and Amazon EventBridge for auditing, monitoring, and notifications.aws.amazon.com · read 30 Sep 2026
- Pricing limits
- Customer-managed AWS KMS keys incur current KMS charges, and automatic rotation other than managed rotation incurs AWS Lambda charges.docs.aws.amazon.com · read 30 Sep 2026
- Programmatic retrieval
- The service supports retrieving one secret or groups of secrets by names, ARNs, or tag filters, and offers client-side caching libraries.aws.amazon.com · read 30 Sep 2026
- Purpose
- AWS Secrets Manager manages access to applications, services, IT resources, database credentials, API keys, and other secrets throughout their lifecycle.aws.amazon.com · read 30 Sep 2026
- Replication
- Secrets Manager can automatically replicate secrets to multiple AWS Regions and keep regional read replicas synchronized.aws.amazon.com · read 30 Sep 2026
- Target users
- AWS describes Secrets Manager as serving IT administrators, security administrators, and developers replacing hard-coded secrets in applications.aws.amazon.com · read 30 Sep 2026
- Third-party integrations
- Managed rotation integrations are listed for Salesforce, BigID, Snowflake, MongoDB Atlas, and Confluent Cloud.aws.amazon.com · read 30 Sep 2026
