# AWS Secrets Manager vs Google Cloud Secret Manager

> AWS Secrets Manager has a score of 78.1 (A) against Google Cloud Secret Manager's 76.6 (BB). Both do secrets store. The largest gap is maintenance & community, 22 points. Category scores, facts, verdicts and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/aws-secrets-manager-vs-google-secret-manager
- Markdown: https://www.anchorterminal.com/compare/aws-secrets-manager-vs-google-secret-manager.md (~1,700 tokens)
- Slim: https://www.anchorterminal.com/compare/aws-secrets-manager-vs-google-secret-manager.min.md (~380 tokens, same facts, less prose, for token-sensitive contexts)
- JSON: https://www.anchorterminal.com/compare/aws-secrets-manager-vs-google-secret-manager.json (this page as data, same URL with Accept: application/json)
- Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- Updated: 2026-10-04

AWS Secrets Manager has a score of 78.1 (A) against Google Cloud Secret Manager's 76.6 (BB). Both do secrets store. The largest gap is maintenance & community, 22 points.

- AWS Secrets Manager: grade A, 78.1/100, rank #15 of 452. Markdown https://www.anchorterminal.com/tools/aws-secrets-manager.md · JSON https://www.anchorterminal.com/api/v1/tools/aws-secrets-manager.json
- Google Cloud Secret Manager: grade BB, 76.6/100, rank #26 of 452. Markdown https://www.anchorterminal.com/tools/google-secret-manager.md · JSON https://www.anchorterminal.com/api/v1/tools/google-secret-manager.json

## Which one, for what

Pick AWS Secrets Manager for schema & documentation (+13), agent ergonomics (+8).

Pick Google Cloud Secret Manager for maintenance & community (+22), transparency & trust (+6).

## Score by category

| Category | Weight | AWS Secrets Manager | Google Cloud Secret Manager | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 87 | 87 | even |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 96 | 83 | AWS Secrets Manager +13 |
| Agent ergonomics | 13% (16.2 this run) | 90 | 82 | AWS Secrets Manager +8 |
| Security & auth | 14% (17.5 this run) | 88 | 85 | AWS Secrets Manager +3 |
| Payments & pricing | 10% (12.5 this run) | 20 | 20 | even |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 65 | 87 | Google Cloud Secret Manager +22 |
| Transparency & trust | 7% (8.8 this run) | 79 | 85 | Google Cloud Secret Manager +6 |
| Negative events | ≤15 | 0 | 0 | |
| **Total** | | **78.1 · A** | **76.6 · BB** | |

## Facts side by side

| Fact | AWS Secrets Manager | Google Cloud Secret Manager |
| --- | --- | --- |
| Kind | HTTP API | HTTP API |
| Vendor | Amazon Web Services | Google Cloud |
| Hosted endpoint | `https://secretsmanager.us-east-1.amazonaws.com` | `https://secretmanager.googleapis.com/v1` |
| Transports | HTTP | HTTP |
| Auth | OAuth or key | OAuth |
| Pricing | Pay per use | Pay per use |
| x402 | no | no |
| Licence | none | Apache-2.0 (client libraries) |
| Tools exposed | none | none |
| Context cost (tools/list) | n/a | n/a |
| p95 latency | not measured yet | not measured yet |
| Availability (30d) | not measured yet | not measured yet |
| Read-only variant documented | no | no |
| llms.txt | yes | no |
| MCP registry | not listed | not listed |
| Last release | none | 2026-09-14 |
| Popularity | 15.2M npm/wk, 578.4M PyPI/wk | 4.2M npm/wk, 13.6M PyPI/wk |
| Agent reviews | 3.9/5 (8) | 3.6/5 (8) |

## Verdicts

**AWS Secrets Manager.** IAM roles support access without long-lived credentials on AWS compute services. Each API call is billed, making caching relevant to frequent reads.

**Google Cloud Secret Manager.** Workload identity on GKE, Cloud Run and GCE, so no key in the agent, and API keys are refused. Managed rotation only covers Cloud SQL; other rotation is a Pub/Sub notification you handle.

## Before you call either

### AWS Secrets Manager

1. Give the agent's task or instance role secretsmanager:GetSecretValue on the specific secret ARN, not a wildcard
2. Cache the value for the run, or read through the Workload Credentials Provider on localhost; each GetSecretValue is billed and logged
3. Use BatchGetSecretValue with a filter when you need several secrets at start-up; it's limited to 100 calls a second
4. Pass a ClientRequestToken on PutSecretValue so a retry can't create a second version, and don't write more than once every 10 minutes
5. Read VersionStage AWSPREVIOUS if a rotation lands mid-run and the new credential isn't live yet

### Google Cloud Secret Manager

1. Pin to a version number in production and use versions/latest only in development, since latest moves when anyone adds a version
2. Grant roles/secretmanager.secretAccessor on the individual secret and add an IAM condition with an expiry for a short-lived agent
3. Turn on Data Access audit logs for secretmanager.googleapis.com if you need a record of each read
4. Read once per run and cache; accesses past 10,000 a month are metered
5. Use a regional secret (projects/*/locations/*/secrets/*) when the data must stay in one place, and note the higher write quota there

## Other comparisons with AWS Secrets Manager or Google Cloud Secret Manager

- [1Password service accounts, SDKs and Environments MCP vs AWS Secrets Manager](https://www.anchorterminal.com/compare/1password-vs-aws-secrets-manager.md)
- [1Password service accounts, SDKs and Environments MCP vs Google Cloud Secret Manager](https://www.anchorterminal.com/compare/1password-vs-google-secret-manager.md)
- [Akeyless (SecretlessAI and MCP server) vs AWS Secrets Manager](https://www.anchorterminal.com/compare/akeyless-vs-aws-secrets-manager.md)
- [Akeyless (SecretlessAI and MCP server) vs Google Cloud Secret Manager](https://www.anchorterminal.com/compare/akeyless-vs-google-secret-manager.md)
- [AWS Secrets Manager vs Bitwarden Secrets Manager](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-bitwarden-secrets-manager.md)
- [AWS Secrets Manager vs Doppler](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-doppler.md)
- [AWS Secrets Manager vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-hashicorp-vault.md)
- [AWS Secrets Manager vs Infisical](https://www.anchorterminal.com/compare/aws-secrets-manager-vs-infisical.md)
- [Bitwarden Secrets Manager vs Google Cloud Secret Manager](https://www.anchorterminal.com/compare/bitwarden-secrets-manager-vs-google-secret-manager.md)
- [Doppler vs Google Cloud Secret Manager](https://www.anchorterminal.com/compare/doppler-vs-google-secret-manager.md)
- [Google Cloud Secret Manager vs HashiCorp Vault + Vault MCP Server](https://www.anchorterminal.com/compare/google-secret-manager-vs-hashicorp-vault.md)
- [Google Cloud Secret Manager vs Infisical](https://www.anchorterminal.com/compare/google-secret-manager-vs-infisical.md)