GCP Secret Manager cost: per secret version and per access

Quick answer

Secret Manager charges about $0.06 per active secret version per location per month and about $0.03 per 10,000 access operations, with a small free tier. It is inexpensive unless you keep many active versions or access secrets on every request. Caching retrieved secrets in your application and disabling old versions keep it near zero.

Google Cloud Secret Manager stores API keys, passwords, and certificates. Its pricing has two parts, active secret versions and access operations, and both are small, so for most teams it is a negligible line. The two ways it grows are version sprawl and applications that fetch secrets on every request.

Versions and access operations

Dimension	Rate (approximate)
Active secret version	~$0.06 / version / location / month
Access operations	~$0.03 / 10,000
Free tier	Small monthly allowance

Each active version of a secret costs a few cents per month per location it is replicated to, and accessing a secret is a fraction of a cent per operation. A secret with a handful of versions accessed occasionally costs almost nothing.

Where it grows

Two patterns add up. Keeping every old secret version active (rather than disabling or destroying rotated ones) accrues per-version cost across many secrets and locations. And an application that calls Secret Manager on every request, instead of fetching a secret once and caching it, generates large access-operation volume, the same anti-pattern as calling KMS on every request.

Controlling Secret Manager cost

Cache retrieved secrets in your application for their lifetime rather than fetching them per request, disable or destroy old versions after rotation so you pay only for active ones, and be deliberate about multi-region replication since each location multiplies the per-version cost. Done this way, Secret Manager stays a rounding error on the bill.

FAQ

How is GCP Secret Manager priced?

About $0.06 per active secret version per location per month and about $0.03 per 10,000 access operations, with a small free tier. Both are small, so for most teams Secret Manager is a negligible cost unless versions sprawl or secrets are accessed on every request.

How do I reduce Secret Manager cost?

Cache retrieved secrets in your application rather than fetching them on every request, disable or destroy old secret versions after rotation so you pay only for active ones, and limit multi-region replication since each location multiplies the per-version cost.

Why would Secret Manager cost be high?

Two patterns: keeping many old secret versions active across many secrets and locations accrues per-version cost, and an application that calls Secret Manager on every request instead of caching generates large access-operation volume. Both are easy to fix.

Should I cache secrets from Secret Manager?

Yes. Fetching a secret once and caching it for its lifetime, rather than calling Secret Manager on every request, sharply reduces access operations and cost, and improves latency. Refresh the cache on rotation or a sensible interval rather than per request.

Does multi-region replication affect Secret Manager cost?

Yes. Each active secret version is billed per location it is replicated to, so replicating secrets across many regions multiplies the per-version cost. Replicate to the regions you actually need rather than everywhere by default.

Does C3X estimate Secret Manager cost?

C3X prices the google_secret_manager_secret resource from your Terraform, so the per-version cost appears before deploy. Access-operation volume depends on how your application retrieves secrets, which you provide as a usage assumption.

What to do next

Price your secrets and the stack around them before you deploy. C3X reads your Terraform and prices your resources against a live catalog. Start with the quickstart.