# Unused Secrets Manager Secret

> Secrets Manager charges $0.40 per secret per month regardless of use, and AWS records a LastAccessedDate on every read. ZopNight fires only when that producer signal proves at least 90 days without access, and it refuses to nominate secrets whose names mark regulated credentials like KYC or UIDAI material.

Source: https://zop.dev/integrations/aws/recommendations/unused-secrets-manager-secret
Updated: 2026-08-19

---

## Measured non-use, not suspicion

This rule used to fire on existence and ask users to go verify: noise wearing a
recommendation's clothes. The current gate is a measurement: Secrets Manager stamps a
last-accessed date whenever a secret is read, discovery carries it through (or a
never-accessed marker plus the creation date), and the rule computes the unused age from
that. Only 90+ proven days of silence fires; a secret with no access signal at all abstains,
because unprovable is not the same as unused.

## A compliance veto that overrides the math

Secrets whose names identify regulated credentials (KYC, Aadhaar, UIDAI, CKYC patterns)
are never nominated, whatever their access history says. Two reasons stack: the $0.40
standing fee is trivial against the operational risk of deleting a regulated credential, and
the access signal itself under-reports for exactly these secrets, which are often read at
deploy time, during rotation, or cross-account in ways the day-granular timestamp can miss.
A cheap saving with a catastrophic tail is not a saving.

## Where the dollar figure comes from

Deleting a secret recovers its flat standing fee. When the pricing pipeline has a real
per-secret cost it is used; when the lookup misses, the rule falls back to [the published
$0.40 per-secret monthly rate](https://aws.amazon.com/secrets-manager/pricing/) rather than shipping a $0 card. That is the one case in this family where a
fixed public price stands in, because the fee genuinely is flat and deterministic.

## Check the access dates yourself

```bash
aws secretsmanager list-secrets \
  --query 'SecretList[].[Name,LastAccessedDate]' --output table
```

Blank dates on old secrets are the strongest candidates; confirm with
`describe-secret` per secret before acting.

## Delete with the recovery window, always

Secrets Manager's scheduled deletion holds the secret recoverable for 7 to 30 days. Take
the window, never force immediate deletion. The classic failure is the quarterly or annual
job whose credential looks months-dead in June and is desperately needed in January; the
recovery window plus a calendar note covers the quarterly case, and a grep through IaC and
CI configuration for the secret's name covers the reference nobody remembered.