Secrets management cost compared: AWS vs Azure vs GCP vs Vault

Quick answer

AWS Secrets Manager charges per secret per month (~$0.40) plus per 10k API calls, so cost scales with the number of secrets. Azure Key Vault and GCP Secret Manager charge mostly per operation (with cheap or free secret storage), so cost scales with access volume. Self-hosted Vault has no per-secret fee but carries operational (or Enterprise license) cost. Few secrets accessed often favor per-operation models; many secrets favor watching the per-secret fee.

Managing secrets, database credentials, API keys, certificates, has a cost that differs in shape across providers: per-secret-per-month, per-operation, or operational overhead for self-hosted. The cheapest depends on how many secrets you store and how often you access them.

Three cost shapes

Service	Model
AWS Secrets Manager	~$0.40/secret/month + per 10k API calls
Azure Key Vault	Mostly per operation; secret storage cheap
GCP Secret Manager	Per active secret version + per access operation
HashiCorp Vault (self-hosted)	No per-secret fee; compute + ops (or Enterprise license)

AWS Secrets Manager charges about $0.40 per secret per month plus per API call, so many secrets add up, as in Secrets Manager. Azure Key Vault charges mostly per operation with inexpensive storage, and GCP Secret Manager charges per active secret version plus per access, as in GCP Secret Manager. Self-hosted Vault has no per-secret fee but you run and maintain it (or pay for Vault Enterprise).

Which is cheaper

For many secrets accessed infrequently, AWS Secrets Manager's per-secret monthly fee dominates and can be the most expensive; the per-operation models (Key Vault, Secret Manager) are cheaper when storage is not the driver. For few secrets accessed heavily, per-operation cost matters more. Self-hosted Vault avoids per-secret fees but its operational cost only pays off at large scale or when you need its advanced features (dynamic secrets, fine-grained policy).

The shared levers

On all of them: cache secrets in your application rather than fetching on every request (reducing per- operation and API-call charges, the usual optimization for AWS Secrets Manager's API cost), consolidate related values into one secret where sensible rather than many separate secrets (reducing AWS per-secret fees), and delete unused secrets. Retrieving secrets on every invocation instead of caching is the common waste across all providers.

Choosing on cost

Use the provider's native secrets service where your workloads run (native integration, no cross-cloud latency), cache aggressively to cut per-operation and API costs, and reserve self-hosted Vault for cases needing its advanced features or very large scale where per-secret fees would dominate. For most, the managed native service with caching is cheapest in total cost including operations.

FAQ

Which secrets manager is cheapest?

It depends on secret count and access frequency. AWS Secrets Manager charges per secret per month (about $0.40) plus API calls, expensive with many secrets. Azure Key Vault and GCP Secret Manager charge mostly per operation with cheap storage, cheaper when storage is not the driver. Self-hosted Vault avoids per-secret fees but adds operational cost. Use the native service where your workloads run and cache.

How do secrets management pricing models differ?

AWS Secrets Manager charges per secret per month plus per API call, so cost scales with secret count. Azure Key Vault and GCP Secret Manager charge mostly per operation with cheap or free storage, so cost scales with access volume. Self-hosted HashiCorp Vault has no per-secret fee but carries compute and operational cost (or an Enterprise license).

How do I reduce secrets management cost?

Cache secrets in your application rather than fetching on every request (cutting per-operation and API-call charges), consolidate related values into one secret where sensible rather than many separate secrets (reducing AWS per-secret fees), and delete unused secrets. Fetching secrets on every invocation instead of caching is the common waste across all providers.

Is self-hosted Vault cheaper than a managed secrets service?

Only at scale or when you need its advanced features. Vault has no per-secret fee, but you run and maintain it (or pay for Vault Enterprise), and that operational cost only pays off at large secret counts where managed per-secret fees would dominate, or when you need dynamic secrets and fine-grained policy. For most, a managed native service with caching is cheaper in total.

Why does caching secrets reduce cost?

Because per-operation and per-API-call charges scale with how often you fetch secrets. Fetching a secret on every request or function invocation multiplies those charges, while caching the secret in the application and refreshing periodically fetches it far less often. Caching is the highest-impact optimization across all secrets managers.

Does C3X estimate secrets management cost?

C3X prices secrets resources from your Terraform, including AWS Secrets Manager's per-secret component and the configured secrets across providers, so the storage-side cost appears before deploy. Per-operation and API-call cost depends on access volume, which you provide as a usage assumption to compare the models.

What to do next

Compare secrets managers for your workload. C3X reads your Terraform and prices your resources against a live catalog. Start with the quickstart.