AWS Secrets Manager Free Tier 2026 Explained

AWS Secrets Manager doesn't have a simple, permanent free tier that covers every account. New AWS customers may use temporary credits, but stored secrets and API calls still affect your bill after those credits run out. Here’s what the current setup means, where costs appear, and why EnvManager may suit teams managing .env files across local workstations and CI/CD.

We compared the official 2026 pricing pages of five secrets managers: AWS Secrets Manager, AWS Parameter Store, Google Cloud Secret Manager, Doppler, and Infisical. AWS Secrets Manager charges $0.40 per secret monthly and $0.05 per 10,000 API calls, offset by a one-time $200 credit expiring in 12 months. Google Cloud Secret Manager keeps 6 secret versions and 10,000 operations free every month, and Doppler and Infisical also offer permanent free tiers. AWS Secrets Manager is the only one of these 5 services with no permanent free allowance.

AWS Secrets Manager Free Tier 2026: The Current Status

The AWS Secrets Manager free tier is best understood as account credit, not unlimited free storage. New customers may receive account credits. Those credits can apply to eligible services, including Secrets Manager.

The free plan lasts six months after account creation. All credits must be used within 12 months. If you switch to a paid account, any remaining credit balance applies to eligible AWS bills. That distinction matters because a credit balance can hide usage costs during the first few months.

After the credit window ends, Secrets Manager charges based on two main usage areas:

• How many secrets you store.
• How often applications or users call the service.

There are no upfront costs or long-term contracts. You pay for use. But “no upfront cost” does not mean “no bill.” A development account can stay quiet for weeks, then grow quickly when a service starts polling secrets too often.

AWS also continues to add features around key control. In 2026, the Secrets Manager console added support for entering a customer-managed KMS key ARN from another AWS account. That helps teams with cross-account encryption workflows, but it doesn’t remove KMS or Secrets Manager usage considerations.

For billing, check the account’s billing usage details rather than relying only on the credit balance.

What the AWS Secrets Manager Free Tier Includes

Eligible new accounts can use AWS credits against eligible service charges. Your account still records the underlying Secrets Manager usage.

Secrets Manager stores sensitive values such as database credentials, API keys, OAuth tokens, and private keys. It also supports lifecycle work, including scheduled rotation for supported secrets. AWS describes the service as a central place to manage secrets through their lifecycle.

That makes it a strong fit when your application already runs inside AWS. The service connects with workloads such as Lambda and ECS. It also fits with IAM access policies, CloudTrail records, VPC endpoints, and other AWS controls.

But the free-tier question gets harder when you compare Secrets Manager with Parameter Store. Parameter Store has a standard tier for many configuration values. Secrets Manager is the better fit for credentials that need controls such as automatic rotation, cross-account access, or fine-grained audit logging.

Parameter Store also has different limits for standard and advanced parameters. Standard parameters support values up to 4 KB, while advanced parameters support values up to 8 KB. The standard tier has no additional charge, but higher throughput and advanced features can add cost.

The distinction matters when choosing between the services. Do not move passwords into Parameter Store just to avoid a charge. Pick the service based on the control your secret needs.

For development teams, the bigger question is workflow. If every developer needs a local .env file, AWS console access may be too slow. A central tool such as EnvManager for developers focuses on pulling and pushing environment values from the terminal.

That can reduce manual copying during a handoff. It also gives the team one place to manage the values used across development and deployment.

Where Included Usage Can Become a Paid AWS Bill

AWS Secrets Manager costs can rise in two ways: more secrets stay stored, or applications make more API calls. The question of included Secrets Manager usage therefore needs an operational answer. You must know how your code retrieves secrets.

Secret count is only the first input

A small team may store database credentials, service keys, certificates, and third-party tokens. Each stored secret adds to the monthly storage total. Temporary secrets can also matter if your system creates them often and leaves them stored longer than needed.

Still, rotation can trigger Lambda runs or other related services. Those services may have their own billing rules.

API calls can become the hidden cost

Many applications retrieve a secret at startup and cache it. That pattern keeps request volume low. Others call Secrets Manager on every request, worker cycle, or database connection refresh. The second pattern can produce a much larger request count.

Imagine 20 services each fetching the same secret every few seconds. The stored-secret count may look small, but the request volume can move far beyond a quiet development setup. A cache with a clear refresh rule often gives you better control.

Use CloudTrail and billing tools to compare request activity with your bill. Review which role made each request. Then check whether the application needs a fresh value each time.

Also watch related services. A customer-managed KMS key may add KMS charges. A rotation function may add Lambda charges. VPC endpoints can affect network costs. Secrets Manager itself is only one line in the final account total.

Teams that want a flat workflow for environment values may prefer EnvManager when their stack is not strictly AWS-based. EnvManager encrypts .env values, keeps versions, and syncs secrets to local machines and CI/CD pipelines. That avoids forcing every developer workflow through AWS IAM and console permissions.

For teams comparing storage models, plan the handoff of environment values across development, staging, and production. The environment variable management guide is available for additional context. The right choice depends on where your applications run and how often people need local access.

AWS Secrets Manager vs. EnvManager for Team Secret Management

AWS Secrets Manager and EnvManager solve related problems, but they start from different workflows. AWS Secrets Manager is built for applications that need secret access inside AWS. EnvManager is built around centralized .env management for developers and delivery pipelines.

EnvManager

EnvManager is the better first choice when your team needs shared environment files across local machines and CI/CD. We encrypt values on import, keep versions, and control access with role-based permissions. The goal is simple: fewer copied secrets in chat, tickets, and random local files.

That workflow helps when a developer joins a project or moves from staging to production. Instead of sending a new file by hand, you can grant access to the right project. The developer then syncs the current values to the approved environment.

EnvManager also fits teams that use more than AWS. Your application may run across several hosting providers, local machines, and CI jobs. A development-focused secret workflow keeps those values in one place without tying every user to an AWS account.

AWS Secrets Manager

AWS Secrets Manager is the stronger fit when your workloads already depend on AWS identity and service integrations. IAM policies can control access. AWS also documents integration with logging, monitoring, and notification services.

That depth comes with a tradeoff. AWS-only scope can make cross-platform development feel heavy. Per-secret and per-request pricing can also make costs harder to predict when usage grows.

There is no single winner for every architecture. If your main pain is AWS runtime access, start with Secrets Manager. If your main pain is secret handoff across developers and pipelines, start with EnvManager and test the sync workflow with one project.

FAQ

Is AWS Secrets Manager free in 2026?

AWS Secrets Manager is not broadly free for every account. New AWS customers may receive credits, which can apply to eligible services, including Secrets Manager. After the credit period or balance ends, AWS charges based on stored secrets and API calls. Check your account terms before relying on the credits.

How long does the introductory credit last?

The current AWS credit program gives new customers a six-month free-plan period, while all credits must be used within 12 months of account creation. A paid-account upgrade can apply the remaining balance to eligible bills. These rules make account age and credit status important when assessing your actual cost.

What causes AWS Secrets Manager charges?

AWS Secrets Manager charges are tied mainly to the number of secrets stored and API calls made. Frequent reads can raise costs even when your secret count stays low. Rotation can also involve other AWS services, such as Lambda or KMS, which may appear as separate billing lines.

Is EnvManager free to use?

EnvManager focuses on encrypted .env management, version control, role-based access, local machine sync, and CI/CD use. Check the current plan terms before assuming a specific number of users, projects, or secrets is free.

Should I use Parameter Store or Secrets Manager?

Use Parameter Store for many standard configuration values, especially when you need its standard tier. Use Secrets Manager for credentials that need purpose-built controls, such as automatic rotation or cross-account access. The right answer depends on the value type and the controls your application requires, not only on the lowest listed price.

Conclusion

Use AWS Secrets Manager when your applications need deep AWS integration and controlled runtime access. Use EnvManager when your team needs a clear way to share .env values across local development and CI/CD. Start with one non-production project, set an AWS budget alert, and measure both secret reads and team setup time before expanding.