GCP Secret Manager cost: per secret version and per access
Secret Manager bills about $0.06 per active secret version per location per month and about $0.03 per 10,000 access operations. It is cheap unless you store many versions or access secrets on every request. Here is the model and the caching lever.
Quick answer
Secret Manager charges about $0.06 per active secret version per location per month and about $0.03 per 10,000 access operations, with a small free tier. It is inexpensive unless you keep many active versions or access secrets on every request. Caching retrieved secrets in your application and disabling old versions keep it near zero.
Google Cloud Secret Manager stores API keys, passwords, and certificates. Its pricing has two parts, active secret versions and access operations, and both are small, so for most teams it is a negligible line. The two ways it grows are version sprawl and applications that fetch secrets on every request.
Versions and access operations
| Dimension | Rate (approximate) |
|---|---|
| Active secret version | ~$0.06 / version / location / month |
| Access operations | ~$0.03 / 10,000 |
| Free tier | Small monthly allowance |
Each active version of a secret costs a few cents per month per location it is replicated to, and accessing a secret is a fraction of a cent per operation. A secret with a handful of versions accessed occasionally costs almost nothing.
Where it grows
Two patterns add up. Keeping every old secret version active (rather than disabling or destroying rotated ones) accrues per-version cost across many secrets and locations. And an application that calls Secret Manager on every request, instead of fetching a secret once and caching it, generates large access-operation volume, the same anti-pattern as calling KMS on every request.
Controlling Secret Manager cost
Cache retrieved secrets in your application for their lifetime rather than fetching them per request, disable or destroy old versions after rotation so you pay only for active ones, and be deliberate about multi-region replication since each location multiplies the per-version cost. Done this way, Secret Manager stays a rounding error on the bill.
FAQ
How is GCP Secret Manager priced?
About $0.06 per active secret version per location per month and about $0.03 per 10,000 access operations, with a small free tier. Both are small, so for most teams Secret Manager is a negligible cost unless versions sprawl or secrets are accessed on every request.
How do I reduce Secret Manager cost?
Cache retrieved secrets in your application rather than fetching them on every request, disable or destroy old secret versions after rotation so you pay only for active ones, and limit multi-region replication since each location multiplies the per-version cost.
Why would Secret Manager cost be high?
Two patterns: keeping many old secret versions active across many secrets and locations accrues per-version cost, and an application that calls Secret Manager on every request instead of caching generates large access-operation volume. Both are easy to fix.
Should I cache secrets from Secret Manager?
Yes. Fetching a secret once and caching it for its lifetime, rather than calling Secret Manager on every request, sharply reduces access operations and cost, and improves latency. Refresh the cache on rotation or a sensible interval rather than per request.
Does multi-region replication affect Secret Manager cost?
Yes. Each active secret version is billed per location it is replicated to, so replicating secrets across many regions multiplies the per-version cost. Replicate to the regions you actually need rather than everywhere by default.
Does C3X estimate Secret Manager cost?
C3X prices the google_secret_manager_secret resource from your Terraform, so the per-version cost appears before deploy. Access-operation volume depends on how your application retrieves secrets, which you provide as a usage assumption.
What to do next
Price your secrets and the stack around them before you deploy. C3X reads your Terraform and prices your resources against a live catalog. Start with the quickstart.
Pricing references
Related posts
- GCP Private Service Connect cost: what private access is worth
Private Service Connect gives you a private IP inside your VPC for a Google or third-party service. It charges per endpoint hour and per gigabyte, and it usually beats routing the same traffic through Cloud NAT.
- GCP Certificate Manager cost: public certs free, private CA priced
Google-managed public TLS certificates are free; the cost is Certificate Authority Service for private CAs, billed per CA per month plus per certificate issued. For public TLS, there is nothing to pay. Here is the model.
- Secrets management cost at scale: per secret fees meet per environment sprawl
Secrets pricing looks trivial at 0.40 dollars per secret per month, then you multiply by 40 services, 5 environments, and rotation versions. Add API call charges from pods that fetch on every start and the bill stops being trivial. Here is how it scales.
- GCP Cloud DNS cost: per managed zone plus per query
Cloud DNS bills about $0.20 per managed zone per month plus about $0.40 per million queries, similar to Route 53. For most domains it is a few dollars. Here is the breakdown and where cost hides for high-query or many-zone setups.
Share this post
Try C3X on your own Terraform
Free and open source. No API key required. One command to install, one command to estimate.