# AWS Secrets Manager vs Parameter Store: which to use > AWS Secrets Manager and Systems Manager Parameter Store compared: price, size limits, rotation, cross-account access and encryption, from AWS's own docs. URL: https://crunu.com/compare/aws-secrets-manager-vs-aws-parameter-store Language: en Updated: 2026-10-30 Use Parameter Store standard parameters for configuration and a modest number of secrets that rarely change: they cost nothing extra. Use Secrets Manager when secrets need automatic rotation, cross-account access or Region replication, at a price per secret and per API call. Both decrypt with AWS KMS inside AWS. AWS answers the "which one" question itself. On its page about Parameter Store policies, AWS writes: "If you manage credentials that require automatic rotation, cross-account access, or fine-grained audit logging, we recommend using AWS Secrets Manager." Parameter Store, a tool of AWS Systems Manager, is a store for configuration data that can also hold encrypted SecureString values, and its standard parameters cost nothing extra. Secrets Manager is purpose-built for credentials and charges per secret and per API call. Both services encrypt with AWS KMS, both are reached through IAM, and both log calls to CloudTrail. The practical differences are price, size, rotation, sharing across accounts and throughput. > **Note:** Crunu wrote this comparison. We make a third option, described near the end, and we compared these two AWS services using only AWS's own documentation and pricing pages, checked on October 30, 2026. Prices change; check the pricing pages before you budget. If something is out of date, tell us at . ## Who each one fits **AWS Secrets Manager fits** credentials that should change on a schedule, such as database passwords, and secrets that several AWS accounts or Regions need. Managed rotation covers many AWS-managed secrets without a Lambda function, and a Lambda function handles the rest. Secrets can be replicated to other Regions and shared with other accounts through resource-based policies. **Parameter Store fits** configuration and a modest number of secrets that change by hand. Standard parameters are free of additional charge, hold up to 4 KB each and cover up to 10,000 parameters per account and Region. Advanced parameters raise those limits and add parameter policies for a monthly fee. Parameter Store can also reference Secrets Manager secrets, so services that read parameters can read secrets too. ## Side by side | | AWS Secrets Manager | Parameter Store | | -------------------- | --------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- | | Price to store | $0.40 per secret per month in AWS's worked examples; each replica is billed as a secret | Standard: no additional charge. Advanced: $0.05 per parameter per month | | Price to read | $0.05 per 10,000 API calls in AWS's worked examples | Standard throughput: no charge for standard parameters. Higher throughput or advanced: $0.05 per 10,000 interactions | | Maximum value size | 65,536 bytes | Standard 4 KB, advanced 8 KB | | How many | Up to 500,000 secrets per account and Region | Standard 10,000, advanced 100,000 per account and Region | | Rotation | Managed rotation for many managed secrets; a Lambda function for others | None built in; advanced parameter policies can expire a parameter or send notifications | | Cross-account access | Resource-based policies on each secret | Advanced parameters can be shared across accounts; standard cannot | | Multi-Region | Replication across Regions | Per Region | | Encryption | AWS KMS; the service decrypts the value before returning it | SecureString values encrypted and decrypted with AWS KMS; parameter names stay in plaintext | | Audit | CloudTrail records API calls | CloudTrail records Systems Manager API calls, including Parameter Store | | CI pipelines | IAM roles assumed through an OIDC identity provider, such as GitHub Actions | The same IAM roles | | Kubernetes on EKS | AWS Secrets and Configuration Provider for the Secrets Store CSI Driver | The same provider mounts parameters as files | ## What it costs in practice Parameter Store has two separate settings that affect the bill. The tier of each parameter, standard or advanced, controls its size limit, policies and monthly charge. Throughput, standard or higher, applies to Parameter Store as a whole and controls the request rate. AWS defines an API interaction as one request touching one parameter, so a single Get that returns ten parameters counts as ten interactions. With standard parameters and standard throughput, there is no additional charge at all. Secrets Manager charges for every secret and every call. At the rates in AWS's worked examples, 50 secrets read 1,000 times a day in total cost about $20 a month, almost all of it for storage. Replicating those secrets to a second Region doubles the storage part, because each replica is billed as its own secret. New AWS customers get Free Tier credits that can be applied to Secrets Manager. For a small team with a few dozen secrets that change by hand, Parameter Store standard parameters can be enough. The cost question changes once you need rotation, cross-account access or larger values. ## Who can decrypt Both services hold the keys for you. Secrets Manager "decrypts the secret value before returning it to the caller", and its secret names and descriptions are not encrypted. *Figure: Diagram of who can decrypt AWS Secrets Manager values, split into your side and the provider side. On your side, your team’s devices, your machines, and CI runners can decrypt. On the provider side, the AWS Secrets Manager service holds the key and can decrypt values too. Cloud IAM principals with decrypt permission can decrypt as well.* Parameter Store uses AWS KMS "to encrypt and decrypt the parameter values of SecureString parameters", and its parameter names stay in plaintext. In both services, a customer managed KMS key lets you control through IAM who may use the key, but decryption still happens inside AWS for any principal your policies allow. *Figure: Diagram of who can decrypt AWS Systems Manager Parameter Store values, split into your side and the provider side. On your side, your team’s devices, your machines, and CI runners can decrypt. On the provider side, the AWS Systems Manager Parameter Store service holds the key and can decrypt values too. Cloud IAM principals with decrypt permission can decrypt as well.* ## Where Secrets Manager is stronger - **Rotation.** Managed rotation for many AWS-managed secrets, and Lambda-based rotation for the rest. Parameter Store has expiration policies and notifications, not rotation. - **Sharing and Regions.** Resource-based policies for cross-account access on every secret, and replication across Regions. - **Larger values.** Up to 64 KB per secret, compared with 4 KB or 8 KB. - **AWS's recommendation for credentials.** AWS itself points credentials that need rotation, cross-account access or fine-grained audit logging to Secrets Manager. ## Where Parameter Store is stronger - **Cost.** Standard parameters and standard throughput carry no additional charge. - **One place for configuration.** Plain settings and SecureString secrets live in the same hierarchy, read with the same API. - **Bridges to Secrets Manager.** Parameter Store can reference Secrets Manager secrets, so services that already read parameters can read secrets without a new integration. - **Simple limits for small setups.** Up to 10,000 standard parameters per account and Region, with no additional charge. ## A third option: Crunu Crunu, which wrote this page, is for teams whose secrets are shared between people, laptops and CI as well as servers, and who do not want any cloud service to decrypt them. Values are encrypted in the browser and the `crunu` agent, and the server stores only ciphertext; each environment has its own key, sealed to each person, machine and pipeline. Pipelines on GitHub Actions, GitLab CI or Bitbucket Pipelines use service tokens bound by OIDC. People can drag `.env` files and `~/.aws/credentials` into an environment and run programs with `crunu run`. It is free during early access. The server still sees metadata such as names, email addresses and timestamps, as the [limitations page](https://crunu.com/security/limitations) explains. Crunu is not a fit for workloads that should read secrets through IAM roles, need rotation of database credentials, or run on EKS: it has no IAM integration, no rotation of values at providers and no Kubernetes support. See [Crunu vs AWS Secrets Manager](https://crunu.com/alternatives/aws-secrets-manager) for the full comparison, or [HashiCorp Vault vs AWS Secrets Manager](https://crunu.com/compare/hashicorp-vault-vs-aws-secrets-manager) if you are weighing a self-run vault. ## FAQ ### Is Parameter Store free? Standard parameters are available at no additional charge, and API interactions with them are free at standard throughput. Advanced parameters are billed per parameter per month, and higher throughput or interactions with advanced parameters are billed per 10,000 interactions. ### When should I use Secrets Manager instead of Parameter Store? When a secret needs automatic rotation, cross-account access through a resource-based policy, replication to other Regions or values larger than 8 KB. AWS's own documentation recommends Secrets Manager for credentials that need rotation, cross-account access or fine-grained audit logging. ### Can Parameter Store rotate secrets? No. Parameter Store has no built-in rotation. Advanced parameters support policies that expire a parameter or send a notification before it expires or when it has not changed, which can remind you to rotate by hand or start your own process. ### Is Parameter Store SecureString as secure as Secrets Manager? Both encrypt values with AWS KMS and decrypt them inside AWS for callers your IAM policies allow, and both log calls to CloudTrail. The differences AWS points to are features: it recommends Secrets Manager for credentials that need rotation, cross-account access or fine-grained audit logging. ### Can I read Secrets Manager secrets through Parameter Store? Yes. Parameter Store can reference Secrets Manager secrets, so services that support Parameter Store references, such as Amazon EC2, Amazon ECS, AWS Lambda and CloudFormation, can retrieve them the same way they read parameters. ## Sources - [AWS Secrets Manager pricing](https://aws.amazon.com/secrets-manager/pricing/) (accessed 2026-10-30) - [AWS Systems Manager pricing (Parameter Store)](https://aws.amazon.com/systems-manager/pricing/) (accessed 2026-10-30) - [Parameter Store: choosing parameter tiers](https://docs.aws.amazon.com/systems-manager/latest/userguide/parameter-store-advanced-parameters.html) (accessed 2026-10-30) - [Parameter Store: parameter policies](https://docs.aws.amazon.com/systems-manager/latest/userguide/parameter-store-policies.html) (accessed 2026-10-30) - [Parameter Store: throughput](https://docs.aws.amazon.com/systems-manager/latest/userguide/parameter-store-throughput.html) (accessed 2026-10-30) - [Parameter Store: SecureString and AWS KMS](https://docs.aws.amazon.com/systems-manager/latest/userguide/secure-string-parameter-kms-encryption.html) (accessed 2026-10-30) - [Referencing Secrets Manager secrets from Parameter Store](https://docs.aws.amazon.com/systems-manager/latest/userguide/integration-ps-secretsmanager.html) (accessed 2026-10-30) - [AWS Secrets Manager encryption](https://docs.aws.amazon.com/secretsmanager/latest/userguide/security-encryption.html) (accessed 2026-10-30) - [AWS Secrets Manager rotation](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html) (accessed 2026-10-30) - [AWS Secrets Manager quotas](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_limits.html) (accessed 2026-10-30) - [AWS Secrets Manager replication](https://docs.aws.amazon.com/secretsmanager/latest/userguide/replicate-secrets.html) (accessed 2026-10-30) - [AWS Secrets Manager logging with CloudTrail](https://docs.aws.amazon.com/secretsmanager/latest/userguide/monitoring-cloudtrail.html) (accessed 2026-10-30) - [Systems Manager logging with CloudTrail](https://docs.aws.amazon.com/systems-manager/latest/userguide/monitoring-cloudtrail-logs.html) (accessed 2026-10-30) - [AWS IAM: OIDC identity providers](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.html) (accessed 2026-10-30) - [Parameter Store with Amazon EKS](https://docs.aws.amazon.com/systems-manager/latest/userguide/integrate_eks.html) (accessed 2026-10-30)