# AWS Secrets Manager Secret

> Secrets Manager bills every stored secret a flat monthly fee plus per-API-call charges for reads and writes. Secrets for applications retired years ago keep billing until deleted. ZopNight discovers each secret on the 6-hour cycle, attributes its cost from Cost Explorer or CUR 2.0, and flags unused secrets for cleanup.

Source: https://zop.dev/integrations/aws/secret
Updated: 2026-08-19

---

AWS Secrets Manager stores and rotates credentials, billed per secret per month plus API calls. Secrets for retired applications persist and bill indefinitely unless cleaned up.

## Per-secret pricing and its long tail

The meter is simple: a flat monthly charge for every secret stored, plus a small charge metered per API call against the service. Rotation itself adds no direct Secrets Manager fee, though the Lambda functions doing the rotating bill as Lambda. What makes the line item grow is lifecycle asymmetry: secrets get created at every application birth, database provisioning, and third-party integration, but application death rarely includes a deletion step, so the population only rises. A secret is also the last thing anyone deletes willingly, since a wrongly removed credential can break something obscure.

## Unused-secret detection in ZopNight

Every secret is discovered through a dedicated provider on the 6-hour cycle, with per-secret cost attributed from Cost Explorer or CUR 2.0. The cleanup recommendation keys off disuse: secrets whose last-accessed date sits months in the past, or whose consuming application is demonstrably gone, are flagged as candidates. Secrets Manager softens the risk of acting on those findings. Deletion enforces a recovery window (7 to 30 days) during which a secret can be restored intact, so cleanup here is unusually reversible for a security resource.

## Where dead secrets come from

Retired applications are the bulk: the RDS instance was deleted, its master credential secret was not. Migrations contribute the rest. Teams moving to Parameter Store, Vault, or a new naming convention copy secrets forward and leave the originals; per-environment secrets for preview and staging environments outlive the environments themselves; and rotation experiments leave behind AWSPENDING-stage clones and test secrets that were never promoted.

## Auditing the secrets list

The Secrets Manager console lists secrets with their last-accessed and last-changed dates, which are the two columns that matter. Anything unaccessed for a quarter deserves an owner check; deletion with the maximum recovery window is the cautious default for candidates nobody claims.