Secrets management cost compared: Secrets Manager vs Key Vault vs Secret Manager

Quick answer

AWS Secrets Manager charges about $0.40 per secret per month plus a small per-API-call fee, so its cost scales with secret count. Azure Key Vault and GCP Secret Manager charge mostly per operation with tiny or no per-secret fees, so their cost scales with access frequency. All are cheap; the cheapest depends on whether you have many secrets (favors Key Vault or Secret Manager) or high access volume (favors caching on any).

The three major clouds' secret stores price differently: AWS Secrets Manager leans on a per-secret monthly fee, while Azure Key Vault and GCP Secret Manager lean on per-operation charges. All are inexpensive, and the shared optimization, caching secrets rather than fetching per request, applies to all, but the pricing difference matters if you have many secrets or high access volume.

Two pricing shapes

Service	Main charge	Secondary
AWS Secrets Manager	~$0.40 per secret / month	Small per-API-call fee
Azure Key Vault	Per operation (~$0.03 / 10k)	No per-secret fee (software keys)
GCP Secret Manager	~$0.06 per active version / month	Per access operation (~$0.03 / 10k)

AWS Secrets Manager's per-secret monthly fee means cost scales with how many secrets you store, so thousands of secrets cost hundreds of dollars a month regardless of access. Key Vault charges mostly per operation with no per-secret fee for software-protected secrets, and GCP Secret Manager has a tiny per-version fee plus per-operation charges. The detail is in Key Vault and Secret Manager.

Which is cheaper

If you have many secrets and modest access, AWS Secrets Manager's per-secret fee can make it the most expensive, while Key Vault and GCP Secret Manager (with tiny or no per-secret fees) are cheaper. If you have few secrets accessed heavily, the per-operation services could cost more unless you cache. In practice all three are cheap, and secret count versus access frequency decides at the margin.

The shared lever: cache secrets

On all three, the operation charge is driven by fetching secrets, so caching a retrieved secret in your application for its lifetime (refreshing on rotation or an interval) rather than fetching on every request sharply reduces operation cost. AWS Secrets Manager also charges for rotation and per-secret storage, so consolidating related values into one secret (rather than many) reduces its per-secret fee.

Choosing on cost

Use the secret store on the cloud where your application runs (for latency and integration), cache secrets to minimize operation cost on any of them, and on AWS Secrets Manager consolidate related values to reduce the per-secret fee. The pricing differences are small in absolute terms, so ecosystem fit and caching matter more than the provider, the same choose-by-ecosystem conclusion as other cross-cloud comparisons.

FAQ

Is AWS Secrets Manager, Azure Key Vault, or GCP Secret Manager cheapest?

It depends on secret count versus access frequency. AWS Secrets Manager charges about $0.40 per secret per month, so many secrets make it pricier. Azure Key Vault and GCP Secret Manager charge mostly per operation with tiny or no per-secret fees, cheaper for many secrets. All are inexpensive; the cheapest is usually the store on your cloud, with caching.

How do secrets management pricing models differ?

AWS Secrets Manager charges per secret per month (about $0.40) plus a small per-API-call fee, so cost scales with secret count. Azure Key Vault charges mostly per operation with no per-secret fee for software keys. GCP Secret Manager has a tiny per-version fee plus per-operation charges. The shapes differ; all are cheap.

What is the shared secrets-management cost lever?

Caching. On all three, operation charges are driven by fetching secrets, so caching a retrieved secret in your application for its lifetime (refreshing on rotation or an interval) rather than fetching per request sharply reduces operation cost. This is the main lever regardless of provider.

Why can AWS Secrets Manager be more expensive?

Because of its per-secret monthly fee (about $0.40), which applies whether or not the secret is accessed. Thousands of secrets cost hundreds of dollars a month regardless of access, whereas Key Vault and GCP Secret Manager have tiny or no per-secret fees. Consolidating related values into one secret reduces the per-secret cost on AWS.

Should I choose a cloud based on secrets management cost?

No. The pricing differences are small in absolute terms, so choose the secret store on the cloud where your application runs for latency and integration, and cache secrets to minimize operation cost on any of them. Ecosystem fit and caching matter more than the marginal provider cost difference.

Does C3X estimate secrets management cost?

C3X prices Secrets Manager, Key Vault, and Secret Manager resources from your Terraform, so per-secret fees appear before deploy. Access-operation volume depends on how your application fetches secrets, which you provide as a usage assumption, though caching keeps it low on all three.

What to do next

Compare secrets stores for your workload. C3X reads your Terraform and prices your resources against a live catalog. Start with the quickstart.