How much does Google Cloud Secret Manager cost?

Per Google's pricing page, active secret versions cost $0.000082192 per version per hour (about $0.06 a month) per location, access operations cost $0.03 per 10,000, and rotation notifications cost $0.05 each. Management operations are free. The always-free tier covers 6 active versions, 10,000 access operations and 3 rotation notifications a month per billing account. Disabled versions count as active and are billed; only destroyed versions are free.

Does Google Cloud Secret Manager rotate secrets automatically?

No. You set a rotation schedule (minimum one hour) and Secret Manager publishes a message to a Pub/Sub topic when rotation is due. Your own subscriber, typically a Cloud Run service or Cloud Function, must create the new credential in the target system and add it as a new secret version. Google bills each rotation notification after the first three a month.

Can workloads outside Google Cloud use Secret Manager?

Yes, through the API, but access is still governed by Google Cloud IAM. Workloads on AWS, Azure or on-premises should authenticate with workload identity federation rather than a downloaded service account key, otherwise you have moved the secret-zero problem rather than solved it. Teams with most workloads outside Google Cloud usually prefer a cloud-neutral platform.

What is the size limit for a secret in Secret Manager?

64 KiB per secret version, according to Google's quotas page, which also caps access requests at 90,000 per minute per project. That is enough for keys, passwords, certificates and small JSON credential files, but not for large configuration bundles, which belong in Parameter Manager or storage.

Secrets Management

Google Cloud Secret Manager

Name: Google Cloud Secret Manager review
Item: Google Cloud Secret Manager
Rating: 4.2
Author: SWI Community Team

Founded 2020Mountain View, California, USAPublic (Google/Alphabet)Score 4.2/5Evaluated 2026-10-31Website ↗

Capability scores

Methodology →

Authentication: 3.0
SSO & Federation: 3.0
Authorization: 3.5
Lifecycle & Provisioning: 3.0
MFA & Passwordless: 2.5
Governance & Audit: 4.0
Developer Experience: 4.0
Deployment Flexibility: 3.5
Pricing Transparency: 4.0
Support & Ecosystem: 4.0

Scored 0–5 against a published rubric. Independent analysis, no vendor sponsorship.

Overview

Google Cloud Secret Manager is Google Cloud's managed store for API keys, passwords, certificates and other credentials, with every secret versioned and access controlled through Google Cloud IAM. It became generally available in 2020 and is a Google Cloud service, so there is no separate company or ownership change. It stores and serves secret values; it is not a key management system (that is Cloud KMS) and not a dynamic-secrets engine. For teams that run mainly on Google Cloud it is the default place to take credentials out of code and environment files.

What it is good at

It is simple to adopt and hard to misconfigure. Each secret holds immutable versions you can enable, disable, destroy or address by alias, so rollback is a version change, not a redeploy. IAM roles and conditions apply per secret, which lets you separate who reads, who manages and who rotates, and secret reads can be logged in Cloud Audit Logs once Data Access logging is enabled, which is off by default. Replication is either automatic (Google picks locations, billed as one) or user-managed, and regional secrets pin data to one location for residency rules. Data is encrypted with Google-managed AES-256 keys by default, with customer-managed keys in Cloud KMS as an option. Consumption is native: Cloud Run mounts secrets as files or environment variables, and the GKE add-on mounts them through the Secrets Store CSI driver using workload identity federation instead of keys. Parameter Manager handles non-secret configuration and can reference secrets.

Where it falls short

Rotation is a reminder, not a feature. Per Google's rotation docs, Secret Manager only sends a Pub/Sub notification on schedule; you write and run the code that changes the password in the database and adds the new version. There are no dynamic, leased database credentials of the kind HashiCorp Vault issues, and no built-in PKI. Payloads are capped at 64 KiB per version. The GKE add-on does not support syncing to Kubernetes Secrets, which the open-source CSI driver does. Outside Google Cloud, every caller still needs a Google identity, so multi-cloud estates end up running two or three native stores side by side with AWS Secrets Manager and Azure Key Vault.

Pricing

Published and cheap. Active versions cost about $0.06 per version per month per location, access is $0.03 per 10,000 operations, rotation notifications $0.05 each, and management calls are free, with 6 versions and 10,000 accesses free each month (pricing page). Disabled versions still bill as active, so destroy old versions rather than disabling them. Compare published rates across vendors in the Identity Pricing Transparency Index 2026.

Best for, and who should look elsewhere

Use it if your workloads run on Cloud Run, GKE or Compute Engine: setup takes an afternoon, and the work that remains is IAM design and writing rotation functions. Look elsewhere if you need dynamic secrets, one control plane across clouds and on-prem, or developer-facing environment sync, where Infisical, Doppler or Vault fit better. See the secrets management rankings and the secrets management guide.

Bottom line

The right default for static secrets on Google Cloud: low cost, IAM-native and well integrated. Budget engineering time for rotation, because Google schedules it but does not do it.