AWS Secrets Manager

Overview

AWS Secrets Manager is Amazon's managed secrets management service, tightly bound to IAM, KMS, and CloudTrail. It is the default choice for teams that live inside AWS and want secrets access governed by the same policies and encryption as everything else in their account. In the secrets management category it is the cloud-native, no-extra-vendor option, strongest when your workloads are already AWS-centric.

What it is good at

Authorization is the standout: fine-grained IAM and resource policies plus KMS encryption give precise control, and CloudTrail logging makes auditing solid out of the box. Built-in rotation for RDS, Aurora, Redshift, and DocumentDB works cleanly with Lambda rotation functions, removing a major operational chore. Because it is native, there is no extra infrastructure to run, and it inherits AWS reliability, support, and compliance coverage. For an all-AWS shop, it is the path of least resistance.

Where it falls short

The weaknesses are lock-in and cost. It only runs in AWS, so multi-cloud or on-prem teams end up adding a second tool, defeating the single-layer goal. Pricing is per secret per month plus per API call, which adds up and surprises teams with high read volumes. Custom rotation for non-AWS systems takes effort, and the developer experience, while fine via SDK and CLI, lacks the polished dashboard of niche tools.

Pricing

Published and usage-based. The pricing page (checked 2026-11-05) works its examples at $0.40 per secret per month, prorated by the hour for short-lived secrets, plus $0.05 per 10,000 API calls. There is no separate Secrets Manager trial any more: since 15 July 2025 new AWS accounts get up to $200 in AWS Free Tier credits that apply across services, on a free plan that lasts 6 months, with credits to be used within 12 months of account creation. Costs scale with secret count and access frequency. Model it against flat-rate alternatives with the TCO calculator.

Best for, and who should look elsewhere

Choose it when you are AWS-native and want IAM-governed secrets with native database rotation. For multi-cloud consistency or flat pricing, see Doppler or Infisical; for enterprise governance, Idira Secrets Manager (formerly CyberArk Conjur). Compare directly via AWS Secrets Manager vs HashiCorp Vault.

Bottom line

The natural choice for AWS-native teams wanting IAM-governed secrets and database rotation, less so if you need multi-cloud reach or predictable flat pricing.