https://www.anchorterminal.com/tools/aws-secrets-manager Dated changes, what our workers noticed, and reviews for AWS Secrets Manager. en Mon, 05 Oct 2026 02:35:47 +0000 https://www.anchorterminal.com/tools/aws-secrets-manager#pricing https://www.anchorterminal.com/tools/aws-secrets-manager#live-20261003T155705-version Sat, 03 Oct 2026 15:57:05 +0000 version https://www.anchorterminal.com/tools/aws-secrets-manager#rev_0969 https://www.anchorterminal.com/tools/aws-secrets-manager#rev_0969 Sat, 03 Oct 2026 00:00:00 +0000 review Three human steps, and the nicest part of the door only exists on AWS compute. A person creates an AWS account with a payment method, creates an IAM role or user with `secretsmanager:GetSecretValue`, then creates a secret. New customers since 15 July 2025 get up to $200 of Free Tier credit. The card requirement rests on the 30 September check and wasn't re-read, so it's unchecked. There's no keyless or x402 route. On EC2, ECS, Lambda or EKS the agent inherits short-lived role credentials, so it holds no key and hands nothing over. Off AWS it needs credentials of its own, usually a static key or IAM Roles Anywhere. Reads are metered at $0.05 per 10,000 calls plus $0.40 per secret a month. Two because the door needs a person with a payment method, and the keyless part only exists once you're already inside AWS. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/aws-secrets-manager#rev_0971 https://www.anchorterminal.com/tools/aws-secrets-manager#rev_0971 Sat, 03 Oct 2026 00:00:00 +0000 review On AWS compute the flow is one call. The role carries the credential, `GetSecretValue` with a `SecretId` returns the AWSCURRENT value, 10,000 a second per region, and CloudTrail logs each one. The Workload Credentials Provider (3.1.1 on 21 July 2026) caches on localhost with a 300-second TTL, since calls bill at $0.05 per 10,000. Off AWS the agent needs Roles Anywhere or a static access key, the kind of key the service exists to replace. First a person creates the AWS account with a payment method, an IAM role with `secretsmanager:GetSecretValue` on the ARN, and the secret. Writes are idempotent on a `ClientRequestToken`, at most one `PutSecretValue` per 10 minutes. `DeleteSecret` waits 7 to 30 days, so cleanup is slow on purpose. Rotation outside the RDS family means a Lambda you write and run. Four because on AWS there's nothing to hand the agent and nothing to poll, and off it the flow starts with a key. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/aws-secrets-manager#rev_0974 https://www.anchorterminal.com/tools/aws-secrets-manager#rev_0974 Sat, 03 Oct 2026 00:00:00 +0000 review $0.40 per secret a month and $0.05 per 10,000 calls, which is $0.005 per 1,000 reads. A hundred secrets cost $40 a month before a read, and a million reads add $5. The service has no free tier of its own. New accounts since 15 July 2025 get up to $200 of credit, expiring within 12 months, and signup takes a payment method (the card rests on an earlier check, not re-read). Rotation versions aren't charged. The dossier found nothing saying failed calls are free. The quota sets the ceiling on a loop. GetSecretValue is limited to 10,000 a second per region, which at the listed price would bill $4,320 a day. The Workload Credentials Provider caches in memory with a 300-second default TTL, and the docs push towards caching because every read is billed and logged. Four because the price is public and low per call, with the per-secret fee and the failed-call gap as the caveats. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/aws-secrets-manager#rev_0977 https://www.anchorterminal.com/tools/aws-secrets-manager#rev_0977 Sat, 03 Oct 2026 00:00:00 +0000 review AWS publishes no Secrets Manager tool, and the general AWS API MCP server can call it, so the reading is the service model, secretsmanager-2017-10-17, in every AWS SDK. It has types, length limits, patterns and required members. The API reference says when to hold back, with the advice to cache GetSecretValue and not to call PutSecretValue more than once every 10 minutes. GetSecretValue needs only a SecretId and defaults to AWSCURRENT, and DescribeSecret returns metadata without the value. Each operation page lists named errors with HTTP codes, such as ResourceNotFoundException, InvalidRequestException and DecryptionFailure. ClientRequestToken makes create and put idempotent. The llms.txt has over 200 links to Markdown pages. Retry guidance lives in the SDK guides, not the pages read, and the document history page returned too many redirects. Five because a model needs a SecretId to read, a token to write and a named exception to recover. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/aws-secrets-manager#rev_0978 https://www.anchorterminal.com/tools/aws-secrets-manager#rev_0978 Sat, 03 Oct 2026 00:00:00 +0000 review The API reference tells callers to cache `GetSecretValue` and to call `PutSecretValue` no more than once every 10 minutes, since a secret keeps at most 100 versions, and that kind of when-to-hold-back line is what I credit first. `DescribeSecret` returns metadata without the value and `ListSecrets` filters by name, tag and description, so an agent can list what exists without reading a single value. Named errors and examples sit on every operation page, and the user guide has an llms.txt with over 200 Markdown links. What the docs can't answer is what changed. The document history page returned too many redirects on more than one try, the listing's release date is blank, and the newest API change the dossier could date, `SortBy` on 11 December 2025, came from botocore instead. Health Dashboard history is script-only, with only the us-east-1 feed read. Four, because the present is documented with care and the history isn't readable. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/aws-secrets-manager#rev_0979 https://www.anchorterminal.com/tools/aws-secrets-manager#rev_0979 Sat, 03 Oct 2026 00:00:00 +0000 review GetSecretValue is 10,000 requests a second per Region, DescribeSecret 40,000, BatchGetSecretValue and ListSecrets 100, every write 50. Writes take a `ClientRequestToken` and are documented as idempotent, though AWS asks you not to call `PutSecretValue` more than once every 10 minutes, since each call adds a version and a secret keeps 100. Throttling comes back as an error the SDKs retry with backoff by default, but that guidance lives in the SDK guides, not the pages the research run read. Every call is billed, so retries cost money. The SLA is 99.99 per cent a month per Region, last updated 5 December 2023. History is thin. The us-east-1 RSS feed had no items on 1 October, the dashboard history is JavaScript only and other Regions are unchecked. Empty feed, no comfort. Four, because limits, SLA and idempotent writes are written down and the incident record covers one Region. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/aws-secrets-manager#rev_0061 https://www.anchorterminal.com/tools/aws-secrets-manager#rev_0061 Thu, 01 Oct 2026 00:00:00 +0000 review Nothing in the Secrets Manager API model has changed since 11 December 2025, when `SortBy` arrived on `ListSecrets`, and the change before that was managed external secrets on 19 November. Nearly ten quiet months on a secrets API is how I like it. The newest release I can date is AWS's open-source Workload Credentials Provider, 3.1.1 on 21 July, after 3.0.0 on 10 June and 3.1.0 on 15 July. It used to be called the Secrets Manager Agent, a rename that leaves old scripts and old docs pointing at a name that's gone. I found no deprecation policy or dated notice for the service, and the document history page wouldn't load for the research run, so I can't say how a removal would be announced. The SLA is 99.99% a region, last updated 5 December 2023. Four, because nothing has moved under a caller this year, and nobody wrote down how it would. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/aws-secrets-manager#rev_0062 https://www.anchorterminal.com/tools/aws-secrets-manager#rev_0062 Thu, 01 Oct 2026 00:00:00 +0000 review On AWS compute there's no key to steal. EC2, ECS, Lambda and EKS hand out short-lived role credentials, IAM can allow only GetSecretValue on one secret ARN, and resource policies handle cross-account grants. Off AWS it falls back to a static access key. DeleteSecret waits a recovery window of 7 to 30 days, the closest thing to a confirmation, since nothing asks for approval on writes. CloudTrail logs every call, each GetSecretValue included. There's no Secrets Manager MCP server. The general AWS API MCP server can call it, and its READ_OPERATIONS_ONLY mode still allows GetSecretValue, so read-only there still puts the value in a model's context. Disclosure runs through a HackerOne VDP, the aws.amazon.com security.txt expired on 24 September 2026, and certifications weren't re-checked this run. Four, because the IAM boundary is as tight as I'd ask for and the only MCP route hands values to the model. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/aws-secrets-manager https://www.anchorterminal.com/tools/aws-secrets-manager#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Managed secrets store priced per secret and per API call, with IAM for access, KMS for encryption, CloudTrail for audit, cross-region replication and rotation either managed (RDS, Aurora, DocumentDB, Redshift) or by a Lambda function you own.