aws_secretsmanager_secret_version cost estimation

An aws_secretsmanager_secret_version stores the actual secret value (a password, key, or JSON blob) for a parent aws_secretsmanager_secret. Each rotation or update creates a new version, and Secrets Manager keeps recent versions with staging labels like AWSCURRENT and AWSPREVIOUS. Creating versions is free; there is no per-version charge.

The cost lives on the parent secret and on access, not the version. Secrets Manager bills about $0.40 per secret per month (prorated), plus roughly $0.05 per 10,000 API calls to GetSecretValue and similar actions. Storing multiple versions of a secret does not multiply the $0.40; you pay per secret, regardless of how many versions it holds. The retrieval calls are what scale: an application that fetches a secret on every request, rather than caching it, can run up the per-call charge quickly.

Because versions are free, the optimization is on the secret and its access pattern: cache retrieved values instead of calling GetSecretValue on every request, and consolidate rarely-changing config into fewer secrets to avoid many $0.40/month line items. c3x prices the parent secret and its API call volume and treats individual versions as free.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "aws_secretsmanager_secret_version" "db" {
  secret_id     = aws_secretsmanager_secret.db.id
  secret_string = jsonencode({
    username = "app"
    password = var.db_password
  })
}

Pricing dimensions

What you actually pay for when you provision aws_secretsmanager_secret_version.

Dimension	Unit	What's being charged
Secret version	free	Each stored version of a secret has no charge; you can rotate freely. $0
Parent secret	per secret-month	The secret is billed monthly regardless of how many versions it holds. ~$0.40/month per secret
API calls	per 10,000 calls	GetSecretValue and related retrieval calls are billed per request. ~$0.05 per 10,000 calls

Optimization tips

Common ways to reduce aws_secretsmanager_secret_version cost without changing the workload.

Cache retrieved secret values

Fewer billed API calls

Fetching a secret on every request drives the per-call charge. Cache the value in memory and refresh on an interval or on rotation to cut GetSecretValue volume.

Consolidate related config into one secret

~$0.40/month per secret avoided

Each secret is $0.40/month, but a secret can hold a JSON object with many fields. Grouping related values into one secret avoids paying the per-secret fee many times.

Use Parameter Store for non-sensitive config

Standard SSM Parameter Store parameters are free. Move non-secret configuration there and reserve Secrets Manager for values that need rotation and encryption.

FAQ

Does a Secrets Manager secret version cost money?

No. Individual versions are free. Secrets Manager bills about $0.40 per secret per month plus roughly $0.05 per 10,000 API calls, no matter how many versions the secret holds.

Does rotating a secret and creating new versions increase cost?

Not for the versions themselves. Rotation creates new free versions. The only cost effect is the extra API calls the rotation performs, billed per 10,000 requests.

How do I keep Secrets Manager costs down?

Cache secret values instead of calling GetSecretValue on every request, group related config into fewer secrets to avoid multiple $0.40/month fees, and use free SSM Parameter Store for non-sensitive settings.