Direct answer: assuming one active version per secret, 100/1,000/10,000 secrets and 1M/10M/100M access operations per month, secrets management in 2026 costs about: 100 secrets + 1M ops — Azure Key Vault 3.00, GCP Secret Manager 8.61, AWS Secrets Manager 45.00; 1,000 + 10M — Azure 30, GCP 89.61, AWS 450; 10,000 + 100M — Azure 300, GCP 899.61, AWS 4,500 USD per month. The gap comes from the meter: AWS 0.40/secret/month + 0.05 per 10K calls; GCP 0.06 per active version/month (first 6 free) + 0.03 per 10K access ops (first 10K free); Azure’s public price is 0.03 per 10K operations and does not separately list a per-secret storage fee. The more secrets, the more AWS’s per-secret fee dominates; only at high access volume do the per-operation parts converge.
This guide is for cloud security, platform and procurement teams managing database credentials, API keys, SSH keys, OAuth tokens, CI/CD secrets and rotation. Data cut-off: 7 November 2026; prices come from the US pricing pages/official retail price API of AWS Secrets Manager, Google Cloud Secret Manager and Azure Key Vault, in USD, excluding tax; all TCOs are editorial calculations, not vendor quotes. The “secret/version/operation” definitions differ, so official facts, editorial assumptions and non-comparable items are kept separate.
AWS 0.40/secret/month + 0.05/10K calls; GCP 0.06/active version/month (first 6 free) + 0.03/10K (first 10K free); Azure 0.03/10K operations with no separately listed per-secret fee. 100 secrets/1M ops: AWS 45, GCP 8.61, Azure 3; 10,000/100M: 4,500/899.61/300. Per-secret billing is most expensive at scale; rotation, HSM/Premium and cross-region copies are separate.
Three meters: per secret, per active version, per operation
AWS Secrets Manager: 0.40/secret/month; API calls 0.05 per 10K (the example charges 4,040 calls at 0.02, so no free call allowance); rotation creates a new version with no extra version fee; cross-region replication is billed per secret/month; rotation Lambda/resources are extra. GCP Secret Manager: active secret versions 0.06/version/month, first 6 free; access operations 0.03 per 10K, first 10K/month free; management operations free; rotation notifications 0.05 each (first 3 free); destroyed versions free. Azure Key Vault: standard operations 0.03 per 10K; secret renewal 1.00 each (Standard); automated key rotation 1.00 each; Premium HSM-protected keys/advanced operations extra; Managed HSM billed per instance-hour; the public retail price does not separately list a per-secret storage fee.
| Platform | Storage/version | Access operations | Boundary |
|---|---|---|---|
| AWS Secrets Manager | 0.40/secret/month | 0.05/10K | New rotation version free; cross-region copies extra |
| GCP Secret Manager | 0.06/active version/month; first 6 free | 0.03/10K; first 10K free | Management ops free; rotation notification 0.05 each |
| Azure Key Vault | No separately listed per-secret fee | 0.03/10K | Secret Renewal 1.00; HSM/Premium extra |
Sources: AWS Secrets Manager Pricing, Google Cloud Secret Manager Pricing and Azure Key Vault Pricing/official retail price API (US/US East, accessed 7 November 2026). USD, excluding tax; AWS/GCP use standard prices; Azure uses Standard operation price; HSM, Premium, cross-region, rotation resources, support and migration are separate.
Three tiers: Azure lowest, GCP next, AWS per-secret most expensive
One active version per secret: 100 secrets + 1M ops — Azure 3.00, GCP 8.61 (94 × 0.06 + 990K × 0.03/10K), AWS 45.00 (100 × 0.40 + 1M × 0.05/10K); 1,000 + 10M — Azure 30, GCP 89.61 (994 × 0.06 + 9.99M × 0.03/10K), AWS 450; 10,000 + 100M — Azure 300, GCP 899.61 (9,994 × 0.06 + 99.99M × 0.03/10K), AWS 4,500. Annual: 36/103.32/540; 360/1,075.32/5,400; 3,600/10,795.32/54,000 (Azure/GCP/AWS). As secret count grows, AWS’s 0.40/secret dominates; as operations grow, the 0.03–0.05 per 10K parts converge.
| Scenario | AWS Secrets Manager | GCP Secret Manager | Azure Key Vault |
|---|---|---|---|
| 100 secrets + 1M ops | 45.00 | 8.61 | 3.00 |
| 1,000 secrets + 10M ops | 450.00 | 89.61 | 30.00 |
| 10,000 secrets + 100M ops | 4,500.00 | 899.61 | 300.00 |
Editorial calculation, not a quote. AWS = secrets × 0.40 + ops/10K × 0.05; GCP = max(0, versions − 6) × 0.06 + max(0, ops − 10K)/10K × 0.03; Azure = ops/10K × 0.03. Excludes tax, rotation/renewal, HSM/Premium, cross-region copies, support and migration; one active version per secret is assumed.
Rotation/renewal/HSM: add-ons can change the ranking
AWS rotation creates a new version at no extra version fee, but automated rotation usually needs Lambda/resources, which are extra; cross-region replication is per secret/month. GCP rotation notifications are 0.05 each (first 3 free), and multiple versions add 0.06 per active version; destroyed versions are free. Azure Secret Renewal is 1.00 each and automated key rotation 1.00 each; rotating 1,000 secrets/month adds 1,000 on Azure, 50 on GCP (1,000 notifications) and mainly Lambda resources on AWS; the ranking can change. HSM/Premium: Azure Premium HSM keys 0.90–5.00/key/month, advanced operations 0.15/10K, Managed HSM 4.85/hour; AWS/GCP HSM is also separate, so standard prices cannot be compared directly with HSM.
| Add-on | AWS | GCP | Azure |
|---|---|---|---|
| Rotation | New version free; Lambda/resources extra | Notification 0.05 each (first 3 free) | Secret Renewal 1.00 each |
| Multiple versions | No extra version fee | 0.06/active version/month | Per operation, not per version |
| Cross-region | Per replicated secret/month | Per multi-region/replica | Premium/replication |
| HSM/Premium | Separate | Separate | Premium keys 0.90–5.00; ops 0.15/10K; Managed HSM 4.85/hour |
Sources: the three official pricing pages (accessed 7 November 2026). Only publicly verifiable items are listed; “separate” means confirm on the product/contract page and is not guessed here. Excludes tax, support, migration and monitoring.
Feature boundaries: secret, version, rotation, HSM, cross-cloud
AWS Secrets Manager is strong in native RDS/Redshift rotation, cross-region replication and IAM/KMS integration; it bills per secret, so many secrets are expensive. GCP Secret Manager is strong in version management, IAM, rotation notifications and GCP integration; it bills per active version, so multiple versions add up. Azure Key Vault is strong in unified certificates/keys/secrets, Entra ID, RBAC and HSM/Premium; it bills per operation with no separately listed secret storage fee, fitting many secrets and moderate access. Cross-cloud/multi-cloud requires comparing egress, replication, identity federation and audit, not just per-secret/per-10K.
| Capability | AWS | GCP | Azure |
|---|---|---|---|
| Secret/version | Secret + versions | Versions are core | Secrets/keys/certificates |
| Native rotation | RDS/Redshift etc. | Rotation notifications/integration | Automated key rotation |
| HSM | KMS/CloudHSM extra | Cloud KMS/HSM extra | Premium/Managed HSM |
| Identity | IAM/KMS | IAM | Entra ID/RBAC |
| Typical use | AWS apps/databases | GCP services | Azure/hybrid/certificates |
Sources: the three official product/pricing pages (accessed 7 November 2026). This is a public capability overview; rotation, replication, HSM, compliance, audit and SLA depend on tier/contract. No feature-equivalence assumption is made.
Which option fits which scenario?
AWS apps/RDS/Redshift needing native rotation/cross-region: Secrets Manager, but many secrets at 0.40 each gets expensive; use parameters/tiered caching to reduce calls. GCP services/version management/rotation notifications: Secret Manager, 0.06/version + 0.03/10K, first 6 versions/10K free. Azure/hybrid, many secrets, moderate access, certificates/HSM: Key Vault, 0.03/10K with no separately listed secret storage fee; Premium/Managed HSM extra. Cross-cloud: model egress, replication, identity federation and audit before unit price; do not compare “per secret” alone.
| Scenario | First choice | Why | Check first |
|---|---|---|---|
| AWS/RDS/cross-region | AWS Secrets Manager | Native rotation/replication/IAM | Secret count, calls, Lambda |
| GCP/version management | GCP Secret Manager | 0.06/version + 0.03/10K | Active versions, rotation notifications |
| Azure/hybrid/certs/HSM | Azure Key Vault | 0.03/10K, many secrets friendly | Renewal, Premium/HSM |
| Many secrets/moderate access | Azure/GCP | No per-secret or low version fee | Ops volume, rotation |
| HSM/compliance | All three Premium/HSM | Key protection | Contract/certification/residency |
| Cross-cloud | Distributed by cloud | Egress/replication/identity | Federation/audit |
Sources: the three official pricing pages (accessed 7 November 2026). This is an editorial decision matrix, not vendor advice; actual latency, throughput, rotation reliability, HSM compatibility and support response were not tested.
What should procurement and acceptance specify?
At least ten things: secret count/type, active versions, access volume/peaks, rotation frequency, cross-region/replication, HSM/Premium, identity/permissions, audit/logs, SLA/compliance, migration/clients. Run a 2–4 week POC on real calls and record read latency, rotation success, permissions, audit and the bill; do not compare only “per secret/per 10K”.
- Secrets: databases/API/SSH/OAuth/certificates; count, growth, ownership.
- Versions: active versions, history, destruction policy.
- Access: monthly calls, peak QPS, caching/batching, cross-region reads.
- Rotation: frequency, automatic/manual, retries, notifications.
- Replication: cross-region/multi-account, primary/standby, conflicts.
- HSM: Premium/Managed HSM, key types, compliance.
- Identity: IAM/Entra, RBAC, workload identity, least privilege.
- Audit: access logs, retention, SIEM export.
- Contract: usage/commit, regions, support/SLA, migration.
- POC: 2–4 weeks of real calls; latency, rotation, permissions, audit and bill.
FAQ
What is cheapest for 100 secrets and 1M accesses?
Azure 3.00, GCP 8.61, AWS 45.00 per month. Azure bills per operation with no separately listed secret fee; GCP gives the first 6 versions/10K free; AWS’s 0.40/secret dominates. The gap grows with secret count.
What about 10,000 secrets and 100M accesses?
Azure 300, GCP 899.61, AWS 4,500. AWS is 4,000 storage + 500 calls; GCP 599.64 versions + 299.97 calls; Azure 300 all operations. Secret count is the main variable.
Why is AWS expensive?
It charges 0.40/secret/month, so 10,000 secrets are 4,000/month, plus 0.05/10K calls. Its strengths are native RDS/Redshift rotation, cross-region replication and IAM/KMS integration; with many secrets, use parameters/tiering/caching to control cost.
How does GCP count “versions”?
Active secret versions are 0.06/version/month, first 6 free; multiple versions per secret add up. Access is 0.03/10K with the first 10K/month free; management operations free; rotation notifications 0.05 each (first 3 free).
Does Azure really not charge per secret?
The public retail price is 0.03/10K operations and does not separately list a per-secret storage fee; Secret Renewal is 1.00 each and Premium/HSM are extra. Contract/region may differ; verify with the official calculator.
How much does rotation add?
AWS rotation creates a new version with no extra version fee, but Lambda/resources are extra; GCP rotation notifications 0.05 each; Azure Secret Renewal 1.00 each. Rotating 1,000 secrets/month adds 1,000 on Azure, 50 on GCP, and mainly Lambda resources on AWS; the ranking can change.
How do HSM/Premium compare?
Azure Premium HSM keys 0.90–5.00/key/month, advanced operations 0.15/10K, Managed HSM 4.85/hour; AWS/GCP HSM is also separate. Standard secret prices cannot represent HSM; compliance scenarios need a separate quote.
What hidden costs should we expect?
Rotation/renewal, cross-region replication, HSM/Premium, access logs/SIEM, egress, identity federation, support/SLA, migration/clients and tax. AWS Lambda, GCP multiple versions, and Azure Renewal/HSM are the most-missed items.
Research method and limitations
This article separates “official facts” from “editorial modelling”: AWS 0.40/secret and 0.05/10K, GCP 0.06/active version and 0.03/10K with first 6 versions/10K free, and Azure 0.03/10K plus Renewal/HSM prices come from the three US pricing pages/official retail price API (accessed 7 November 2026); the 100/1,000/10,000-secret and 1M/10M/100M-operation totals are arithmetic on published unit prices, not vendor quotes. It does not compare actual latency, throughput, rotation reliability, HSM compatibility or support response.
Eight limitations: (1) only US/US East public list prices are used, excluding tax, discounts, commitments and regional differences; (2) one active version per secret is assumed; multiple versions change GCP cost; (3) only secret storage/version + access operations are counted, excluding rotation resources, cross-region replication, HSM/Premium, logs, support and migration; (4) Azure’s public price does not separately list a per-secret storage fee; this article bills operations, and contracts may differ; (5) latency, throughput, rotation reliability and HSM compatibility were not tested; (6) HashiCorp Vault, AWS Parameter Store and others are excluded; (7) enterprise contracts may include volume pricing; public prices are used; (8) prices and terms can change by contract, region and exchange rate. Treat this as a secret/version/operation conversion template and replace assumptions with a 2–4 week real-call POC.
Sources and basis
- AWS, Secrets Manager Pricing: aws.amazon.com/secrets-manager/pricing. 0.40/secret/month; 0.05/10K API calls; rotation creates a new version at no extra version fee; cross-region replication extra. Accessed 7 November 2026.
- Google Cloud, Secret Manager Pricing: cloud.google.com/secret-manager/pricing. Active versions 0.06/version/month, first 6 free; access 0.03/10K, first 10K free; management operations free; rotation notifications 0.05 each, first 3 free. Accessed 7 November 2026.
- Microsoft Azure, Key Vault Pricing: azure.microsoft.com/pricing/details/key-vault. Standard operations 0.03/10K; Secret Renewal 1.00 each; automated key rotation 1.00 each; Premium keys 0.90–5.00, operations 0.15/10K, Managed HSM 4.85/hour (East US retail). Accessed 7 November 2026.
Data cut-off 7 November 2026; prices are public list prices excluding tax; all models are editorial calculations. This is not procurement advice.