How to Reduce AWS Secrets Manager and KMS Costs

Last updated: June 2026 · Written by Fredrik Filipsson and reviewed by Morten Andersen · See, Cut, Lock, Run method

AWS Secrets Manager stores and rotates credentials, and AWS KMS manages the keys that encrypt data across your account. Both are security primitives, so their cost is rarely questioned, and that is how they grow: a secret created for every microservice, a customer managed key per resource, and decrypt calls fired on every request instead of being cached. Each line is small, but the pattern repeats thousands of times. This guide is part of our complete guide to AWS cost optimization, the cluster pillar it links up to.

How much do AWS Secrets Manager and KMS cost?

AWS Secrets Manager costs $0.40 per secret per month and $0.05 per 10,000 API calls, while AWS KMS costs $1 per customer managed key per month plus $0.03 per 10,000 requests. The Secrets Manager figures come from the AWS Secrets Manager pricing page: you pay per secret stored and per API request, and you are not charged for new versions created during rotation. The KMS figures come from the AWS KMS pricing page: each customer managed key is $1 per month prorated hourly, requests bill at $0.03 per 10,000, and the first 20,000 requests per month are free in most regions. AWS managed keys carry no monthly key charge and AWS owned keys are free, so the cost concentrates in customer managed keys and request volume. Verify current rates before modeling, since pricing varies by region.

How do I reduce Secrets Manager and KMS cost step by step?

Reduce cost by removing unused resources, moving plain config off Secrets Manager, and cutting KMS API volume. Work through these steps:

1. Inventory secrets and customer managed keys. List every secret and every customer managed key across accounts with AWS Cost Explorer and the consoles, since each secret is $0.40 per month and each key $1 per month whether or not it is read.
2. Delete unused secrets and schedule key deletion. Use AWS CloudTrail to confirm what nothing has accessed, then remove dead secrets and schedule deletion of keys no resource references, respecting the mandatory waiting period.
3. Move non-secret config to Parameter Store. Store plain configuration in Systems Manager Parameter Store standard parameters, which are free, instead of paying $0.40 per month per Secrets Manager entry for values that do not need rotation.
4. Consolidate keys and cut KMS API calls. Share a smaller set of customer managed keys across resources and cache data keys with envelope encryption so fewer Decrypt and GenerateDataKey calls bill at $0.03 per 10,000 requests.
5. Use AWS managed keys where they suffice. Where a service offers encryption with an AWS managed key at no key charge and your policy allows it, avoid creating customer managed keys you do not need.

This is the same waste-elimination work in our AWS cost optimization service. The networking counterpart, where DNS hosted zones and query volume drive cost, is covered in the sibling guide how to reduce Amazon Route 53 and DNS query costs.

Should I use Secrets Manager or Parameter Store?

Use AWS Secrets Manager for credentials that need automatic rotation, cross-account sharing, or fine-grained policies, and use Systems Manager Parameter Store for plain configuration and values that do not. The split is about function and cost together. Secrets Manager bills $0.40 per secret per month and provides built-in rotation, versioning, and tight IAM integration, which is worth paying for on database passwords, API keys, and anything that must rotate on a schedule. Parameter Store standard parameters are free and handle the long tail of configuration, feature flags, and non-sensitive values that teams often park in Secrets Manager out of habit. Moving that long tail to Parameter Store removes the per-secret charge without losing any capability the data actually needed. The table below compares the two.

Verdict: keep rotating credentials in Secrets Manager and move plain, non-rotating configuration to free Parameter Store standard parameters.

Frequently asked questions

How much does AWS Secrets Manager cost?

AWS Secrets Manager costs $0.40 per secret per month and $0.05 per 10,000 API calls. You are not charged extra for creating new versions during rotation. Storing non-secret configuration in Systems Manager Parameter Store standard parameters, which are free, avoids the per-secret charge for data that does not need Secrets Manager.

How much does AWS KMS cost?

AWS KMS costs $1 per customer managed key per month, prorated hourly, plus $0.03 per 10,000 requests. The first 20,000 requests per month are free in most regions. AWS managed keys carry no monthly key charge, and AWS owned keys are free, so the saving comes from consolidating customer managed keys and reducing API calls.

Should I use Secrets Manager or Parameter Store?

Use Secrets Manager for credentials that need automatic rotation and fine-grained access, and Parameter Store for plain configuration and values that do not. Secrets Manager bills $0.40 per secret per month while Parameter Store standard parameters are free, so moving non-rotating config to Parameter Store removes cost without losing function.

What is the biggest hidden KMS cost?

High volumes of Decrypt and GenerateDataKey API calls, and customer managed keys created per resource. Each key is $1 per month and requests bill at $0.03 per 10,000, so envelope encryption that re-fetches data keys instead of caching them, multiplied across a fleet, can dwarf the key storage charge.

The short version

Secrets Manager bills $0.40 per secret per month and KMS $1 per customer managed key plus $0.03 per 10,000 requests. Delete unused secrets and keys, move plain configuration to free Parameter Store, share a smaller set of keys, and cache data keys to cut request volume. When you want every secret and key reviewed and the saving proven down, that is part of what our AWS cost optimization service delivers.