Secrets Manager unused secret cost is the monthly charge for a secret no application reads. AWS bills per secret per month, and bills again for each replica in another Region. API calls add a smaller line. The secret can be a password you rotated for a system that was retired, a token left after a migration, or a duplicate someone created during a cutover. The bill continues until the secret is fully deleted, including the recovery window after you schedule deletion.
The list price in commercial regions is $0.40 per secret per month and $0.05 per 10,000 API calls. A replica is another $0.40 in that Region. Forty forgotten secrets and their replicas are a few hundred dollars a month of pure residue. The CFO notices the line item. Engineering cannot see it in application latency. Rutagon inventories callers, separates rotation theater from real reads, and deletes what nobody uses.
What counts as unused
A secret is unused when the only history you can defend is empty of application GetSecretValue calls for the window you choose with finance, commonly a full review cycle. CloudTrail does not show those calls unless the trail includes Secrets Manager data events. Without data events, the console's last-retrieved time is blank and every secret looks equally mysterious. The first step is data events on AWS::SecretsManager::Secret, scoped so you are not paying for an unbounded trail you will not read. IAM Access Analyzer unused access is a useful sibling for roles and keys. It does not list secret retrievals. This meter is CloudTrail data events plus the secret inventory.
Rotation confuses the meter. A rotation Lambda calls GetSecretValue on a schedule. That call is a read, and it is not proof an application needs the secret. We exclude the rotation role and the Secrets Manager service principal when we score "real callers." A secret whose only caller is its own rotation function is unused by the product, and it is still billing. Rotation versus elimination is the architectural argument for standing secrets you do still use. This article is the invoice for the ones you do not.
Replicas are independent charges. A secret replicated to a second Region for a disaster-recovery design you no longer run still bills $0.40 there. We list ReplicationStatus and ask whether the replica Region has a consumer. No consumer, no replica. Deleting the primary without removing the replica first is how people think they cancelled a charge that remains.
Secrets Manager unused secret cost during deletion
DeleteSecret schedules removal and starts a recovery window. The minimum window is 7 days. The default is longer. During that window the secret still exists and still incurs the monthly charge. RestoreSecret brings it back, which is why the window exists. ForceDeleteWithoutRecovery ends the billing immediately and cannot be undone. We use the window for secrets that might have a forgotten consumer, and force delete only when the inventory shows no real caller and the owner signs the row.
AWS documents the deletion behavior in Delete a secret. The cost control is to finish deletion, not to schedule it and walk away. A quarterly cleanup that only calls DeleteSecret with a 30-day window can still show the secrets on the next invoice.
aws secretsmanager delete-secret \
--secret-id app/retired/db \
--recovery-window-in-days 7
After the window, we confirm DescribeSecret fails with a not-found error and the CUR quantity for that secret id drops. The resource id in CUR is the confirmation finance can match. A spreadsheet that says "deleted" without the CUR drop is not done.
Versions inside one secret do not each cost $0.40. The secret resource does. Cleaning AWSPENDING versions is hygiene. It is not the savings. Extra secrets created "just in case" are the savings. We merge nothing automatically. We delete with an owner.
How the inventory is scored
Each secret row carries: name, owning service if the tag is honest, replica Regions, last real GetSecretValue caller, whether rotation is enabled, and the monthly unit cost including replicas. Tags are often wrong. The caller ARN from CloudTrail beats the tag. Untagged secrets with no callers are first in the delete queue because nobody will defend them.
Secrets referenced by a running ECS task definition, a Lambda environment, or a CloudFormation stack are not unused even if traffic is quiet. We cross-read those definitions. A secret mounted into a task and never fetched still bills, and it is a configuration bug: either the task should fetch it or the mount should go. We do not delete a secret that a running task names until the task definition changes. Order matters. Remove the reference, deploy, then delete the secret. The reverse strands a deployment.
KMS API calls for the secret's key are a separate line and usually small next to the per-secret charge. We do not start a key-deletion project to save this bill. We delete unused secrets and unused replicas. Customer-managed keys that become orphaned can be a follow-up. They are not the headline.
The scorecard fits on one page: count of secrets, count with no real caller, replica surplus, estimated monthly residue at $0.40 each, and the delete list with owners. AWS cloud infrastructure work includes the data-event trail if it was missing, because without it the scorecard is opinion.
We file the delete list and the CUR before-and-after in the GRC you already run when secret inventory is an access or asset control, not only a cost exercise. A secret nobody reads is also a credential you are not rotating with a purpose. Cost is the reason finance will schedule the work. The removal is the security outcome.
Frequently Asked Questions
What is the monthly charge for an unused secret?
Commercial list pricing is $0.40 per secret per month, plus $0.40 for each replica Region, plus $0.05 per 10,000 API calls. Unused means you still pay the monthly fee. The API line is usually the smaller one. Confirm your Region on the pricing page before you forecast.
Does rotation prove the secret is in use?
Only that the rotation function read it. We ignore GetSecretValue from the rotation role when we decide a secret is unused. An application caller is the signal that matters. A secret that only rotates is a candidate for deletion after the owner agrees nothing else needs it.
Why does the bill continue after DeleteSecret?
The recovery window keeps the secret restorable, and the monthly charge continues until deletion finishes. The minimum window is 7 days. ForceDeleteWithoutRecovery stops the charge and cannot be reversed. We force delete only with an owner signature and no real caller in the inventory.
How do you see reads in the first place?
CloudTrail data events for AWS::SecretsManager::Secret. Without them, last-retrieved stays empty. We turn data events on, score callers other than rotation, and cross-check ECS, Lambda, and stack references so a quiet but mounted secret is not deleted out from under a task.
What do you do with secrets that are still real?
They stay, and if they are standing passwords the longer conversation is elimination or a justified rotation. This pass removes residue. It does not replace a workload-identity migration for credentials applications still must read.
Talk to us about an AWS cost scorecard that includes unused secrets. Contact Rutagon at rutagon.com/contact, 907-841-8407, or contact@rutagon.com.