Notifications
Clear all
Topic starter
22/07/2026 4:35 pm
TL;DR: AWS Secrets Manager charges $0.40 per secret monthly plus $0.05 per 10,000 API calls, but the real cost grows with environments, regions, retrieval frequency, and duplicated secrets, according to Akeyless. The security issue is not the unit price, but the governance model that lets secret sprawl, overuse, and stale credentials accumulate across estates.
NHIMG editorial — based on content published by Akeyless: AWS Secrets Manager cost analysis and the hidden economics of secret sprawl
By the numbers:
- Only 44% of organisations are currently using a dedicated secrets management system.
- Secrets management is a top five cybersecurity priority for only 33% of organisations, behind cloud security (45%), API security (42%), and endpoint security (36%).
Questions worth separating out
Q: How should security teams control AWS Secrets Manager costs without weakening secret security?
A: Start by reducing unnecessary secret duplication and runtime fetch volume.
Q: Why do secret sprawl and repeated retrievals create both cost and identity risk?
A: Because every extra copy or fetch expands the places a credential can be exposed, misused, or left stale.
Q: What do teams get wrong about using Secrets Manager for every sensitive value?
A: They assume any sensitive data belongs in the same storage model as a rotating credential.
Practitioner guidance
- Inventory secrets by lifecycle and environment Map each secret to application owner, environment, region, and rotation status so you can see where the estate is multiplying.
- Cache secret retrieval in hot-path workloads Use application caching or the AWS Parameters and Secrets Lambda Extension for workloads that repeatedly call GetSecretValue.
- Move static values out of Secrets Manager Relocate configuration data, flags, and non-rotating values to Parameter Store when they do not need managed rotation.
What's in the full article
Akeyless's full article covers the operational detail this post intentionally leaves for the source:
- AWS pricing examples showing cost at different secret counts and API call volumes
- Step-by-step guidance for caching, JSON consolidation, and when to move values to Parameter Store
- Worked comparisons between Secrets Manager and Parameter Store for different value types
- Customer examples showing how consolidation changes total cost of ownership
👉 Read Akeyless's analysis of AWS Secrets Manager pricing and secret sprawl →
AWS Secrets Manager pricing: what the real secret sprawl bill means?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
22/07/2026 4:40 pm
Secret sprawl is now a governance debt, not just a storage problem. When organisations spread secrets across AWS, other clouds, CI/CD, and on-prem systems, they create a control surface that no single billing model captures. The cost of the vault is often smaller than the cost of tracking where every secret lives, who can fetch it, and whether it still has a business owner. Practitioners should treat secret inventory quality as a core governance metric, not an afterthought.
A few things that frame the scale:
- The average time to mitigate a leaked secret is 36 hours, highlighting the operational burden of manual remediation processes, according to The 2024 State of Secrets Management Survey.
- Only 44% of organisations are currently using a dedicated secrets management system, which helps explain why exposure and remediation still scale manually.
A question worth separating out:
Q: What should teams do when secrets are shared across multiple applications or regions?
A: Reassess ownership, replace shared secrets with workload-specific credentials where possible, and avoid cross-region replicas unless there is a clear operational need. Shared credentials increase blast radius and make offboarding harder, especially when no one can prove which workloads still depend on them.
👉 Read our full editorial: AWS Secrets Manager costs expose the hidden price of secret sprawl
