AWS Secrets Manager
AWS Secrets Manager is a cloud service for managing application and infrastructure secrets, including database credentials and API keys, across their lifecyc…
What AWS Secrets Manager is
AWS Secrets Manager is a cloud service for managing application and infrastructure secrets, including database credentials and API keys, across their lifecycle. Teams can retrieve individual secrets or groups by name, ARN, or tag filter, and use client-side caching libraries. The service encrypts stored secrets with AWS Key Management Service keys and sends retrieved secrets over TLS. IAM and resource-based policies let administrators control access. Secrets can be rotated on a schedule or on demand through the console, AWS SDK, or AWS CLI, and replicated across AWS Regions with synchronized read replicas. Integrations include AWS services such as RDS, Redshift, and CodeBuild, plus managed rotation for selected third-party credentials. CloudTrail, CloudWatch, SNS, and EventBridge support auditing, monitoring, and notifications. It is available through web and API. Pay-as-you-go pricing is $0.40 per secret per month plus $0.05 per 10,000 API calls; the Free Tier offers up to $200 in credits under stated account and expiration terms.
Good
- Scheduled and on-demand secret rotation
- Replicates secrets across AWS Regions
- IAM and resource-based access policies
- Supports API and web access
- Integrates with audit and monitoring services
Watch out
- Customer-managed KMS keys incur separate charges
- Some automatic rotation incurs AWS Lambda charges
- Free Tier credits expire within 12 months
Who it suits
It suits IT and security administrators and developers who need to manage and rotate secrets used by applications or services. It is designed for teams working in AWS environments that need access controls, audit logs, or regional replication.
Verdict
AWS Secrets Manager combines secret storage, access controls, rotation, and auditing in a cloud service with AWS integrations. Account for KMS or Lambda charges where applicable, in addition to usage-based pricing.
Plans and prices
From AWS Secrets Manager's own pricing page, checked 30 Sep 2026.
| Plan | Price | What it gives you |
|---|---|---|
| AWS Free Tier | Free | up to $200 in AWS Free Tier credits · free plan available 6 months after account creation · credits expire within 12 months of account creation |
| Pay-as-you-go | $0.40 a month | $0.40 per secret per month · $0.05 per 10,000 API calls · no upfront costs or long-term contracts · usage-based |
The facts
Each one read from AWS Secrets Manager's own pages, with the date it was checked.
What it does
- Access control
- AWS Identity and Access Management provides fine-grained IAM and resource-based policies for controlling access to secrets.checked 30 Sep 2026
- API and documentation
- AWS publishes a Secrets Manager User Guide and API Reference, and recommends using AWS SDKs for API calls.checked 30 Sep 2026
- Automatic rotation
- Secrets can be rotated on a schedule or on demand through the console, AWS SDK, or AWS CLI.checked 30 Sep 2026
- Compliance
- AWS lists support for compliance workloads involving DoD CC SRG IL2, IL4, and IL5, FedRAMP, HIPAA, IRAP, OSPAR, ISO 27001, ISO 27017, ISO 27018, ISO 9001, PCI-DSS, and SOC.checked 30 Sep 2026
- Encryption
- Secrets Manager encrypts secrets at rest with AWS Key Management Service keys and transmits retrieved secrets over TLS.checked 30 Sep 2026
- Integrations
- Listed AWS integrations include Amazon RDS, Amazon Redshift, Amazon DocumentDB, Amazon MSK, Amazon SageMaker, AWS CodeBuild, and AWS Transfer Family.checked 30 Sep 2026
- Managed external secrets
- Managed external secrets provides predefined partner formats and Lambda-free automatic rotation for third-party credentials.checked 30 Sep 2026
- Monitoring
- Secrets Manager integrates with AWS CloudTrail, Amazon CloudWatch, Amazon SNS, and Amazon EventBridge for auditing, monitoring, and notifications.checked 30 Sep 2026
- Pricing limits
- Customer-managed AWS KMS keys incur current KMS charges, and automatic rotation other than managed rotation incurs AWS Lambda charges.checked 30 Sep 2026
- Programmatic retrieval
- The service supports retrieving one secret or groups of secrets by names, ARNs, or tag filters, and offers client-side caching libraries.checked 30 Sep 2026
- Purpose
- AWS Secrets Manager manages access to applications, services, IT resources, database credentials, API keys, and other secrets throughout their lifecycle.checked 30 Sep 2026
- Replication
- Secrets Manager can automatically replicate secrets to multiple AWS Regions and keep regional read replicas synchronized.checked 30 Sep 2026
- Target users
- AWS describes Secrets Manager as serving IT administrators, security administrators, and developers replacing hard-coded secrets in applications.checked 30 Sep 2026
- Third-party integrations
- Managed rotation integrations are listed for Salesforce, BigID, Snowflake, MongoDB Atlas, and Confluent Cloud.checked 30 Sep 2026
The company
- Founded
- 2006checked 28 Sep 2026
Alternatives to AWS Secrets Manager
- 1
Envshed
Free planWebAPILinuxmacOS7.6From $5 a month - 2
Keyway
Free planWebAPILinuxmacOS7.1From €9 a month - 3
Infisical
Free planWebAPILinuxSelf-hosted7.0From $2 a month - 4
Oracle Cloud Infrastructure Secret Management
Free planWebAPI7.0Free plan - 5
secr
Free planWebAPIExtensionLinux7.0From $6 a month - 6
SikkerKey
Free planWebAPILinuxmacOS7.0From $29 a month