Cloud Cost Sense
Google Secret Manager Cost: Versions, Access, and Rotation
Estimate Google Cloud Secret Manager cost from active versions, replica locations, access operations, and rotation notifications.
Count active versions by replica location
Secret Manager charges for active secret versions, not just secret names. Both enabled and disabled versions are active; destroyed versions are free. Inventory every retained version and remove superseded versions only after your rollback and audit requirements allow it.
Replication changes the count. Automatic replication is billed as one location, while user-managed replication bills each active version once for every configured location. Multiply active versions by billable locations and the fraction of the month they remain active, then subtract the current billing-account free allowance before applying the official rate.
Estimate access operations from application behavior
Accessing a secret version is billable in blocks of 10,000 operations after the monthly free allowance; management operations such as creating a secret, changing a version state, or destroying a version are free. Estimate monthly access as application instances × starts or refreshes × secrets fetched, plus deployments, jobs, and manual access.
Do not assume every request must call Secret Manager. Use supported application caching or startup retrieval when it fits your security and freshness requirements, and avoid accidental polling loops. Measure access operation counts before changing behavior so a cost optimization does not create stale-secret or rotation failures.
Add rotation notifications and adjacent services
A Secret Manager rotation schedule sends a SECRET_ROTATE message to each configured Pub/Sub topic; Secret Manager charges per rotation notification after its free allowance. The notification does not rotate credentials by itself, so also budget for the subscriber and workflow that creates a new version and deploys or refreshes workloads.
Include related Pub/Sub, Cloud Run or function execution, Cloud Logging, and any Cloud KMS costs used by your workflow. Set a billing budget and review active-version, access, and rotation totals monthly. Free allowances and rates are aggregated or updated under Google Cloud pricing rules, so verify the current official pricing page before committing a budget.