AWS Parameter Store vs Secrets Manager: $0 vs $0.40 [2026]

Choosing between AWS Parameter Store and Secrets Manager comes down to one line on the bill and one feature in the console. Parameter Store keeps standard parameters free. Secrets Manager charges $0.40 per secret per month and rotates credentials for you. If you are still wiring up credentials, the step-by-step guide to setting up AWS Secrets Manager covers the console work, and this comparison covers the decision that comes first.

The two services also differ in scale. Parameter Store’s standard tier holds 4 KB values and up to 10,000 parameters per Region per account, and the advanced tier lifts that to 8 KB values and 100,000 parameters, a quota that the Cloud Credits pricing calculator for Systems Manager also lists. AWS Secrets Manager, by contrast, is built around the secret’s lifecycle: storage, retrieval, scheduled rotation and audit. A third service, AWS AppConfig, handles a different job, which is shipping configuration and feature flags to running applications without a redeploy.

This article compares all three as of October 23, 2026, using AWS pricing and documentation pages that were refreshed this month. It covers specs, pricing, cost math at four fleet sizes, rotation, real examples from recent AWS launches, use-case picks, a migration path in both directions, and a final verdict backed by the numbers. One caveat up front: no independent latency benchmark for these services surfaced in our sources, so the performance section deals in documented limits and cost rather than invented millisecond charts.

·

Google · Preferred Sources

Don't miss new tech stories on Google

Add Tech Insider once in the Google app and our stories appear in your news suggestions.

Add Now

The Short Answer: Which AWS Service Should Hold Your Config and Secrets

Use Parameter Store for plain configuration, feature switches, endpoints, AMI aliases and anything small that is not dangerous if it leaks. Use Secrets Manager for credentials that must rotate, such as database passwords, API keys and tokens. Use AppConfig when the value needs to change in production on a controlled schedule, with validation and gradual rollout, rather than on the next deploy.

AWS’s own documentation backs that split. Parameter Store accepts encrypted SecureString values, yet AWS recommends Secrets Manager for database credentials, API keys and tokens because it provides purpose-built controls, including automatic rotation and cross-Region replication. That guidance appears in documentation that AWS updated on October 17, 2026.

The money side is just as clear. At 1,000 items, Parameter Store’s standard tier costs $0 a month in storage, the advanced tier costs $50, and Secrets Manager costs $400, before API calls. Secrets Manager costs 8 times the advanced tier per item ($0.40 against $0.05), and the API rate is identical at $0.05 per 10,000 calls. So the premium buys you rotation and secret-specific tooling, not cheaper reads.

• Pick Parameter Store Standard when values fit in 4 KB, you stay under 10,000 parameters, and rotation is not needed.
• Pick Parameter Store Advanced when you need 8 KB values or up to 100,000 parameters and still do not need managed rotation.
• Pick Secrets Manager when a credential has to rotate on a schedule or on demand, or when a third party credential is on the managed rotation list.
• Pick AppConfig when you want feature flags, dynamic configuration or experiments delivered without a code redeploy.

What Each Service Does in 2026

Two of the three services sit inside the same AWS Systems Manager family, which is why teams confuse them. AWS still lists Parameter Store under Systems Manager’s application tools alongside AppConfig, while Secrets Manager is a separate service with its own pricing page. None of the three has been renamed, retired or acquired. AWS’s current documentation and pricing pages, dated October 2026, use the same product names as before.

AWS Systems Manager Parameter Store

Parameter Store is a key-value store for configuration data and, optionally, encrypted strings. It lives inside AWS Systems Manager, so IAM policies and the Systems Manager console apply to it. It offers two tiers, Standard and Advanced. Standard parameters carry no additional storage charge, accept values up to 4 KB, and cap at 10,000 per Region per account. Advanced parameters cost $0.05 per parameter per month, prorated hourly when stored for less than a month, accept values up to 8 KB, and cap at 100,000 per Region per account.

Parameter Store keeps the 100 most recent versions of a parameter. When a new version is written, the oldest unlabeled version is removed. If that oldest version carries a label, the write can fail, which is a quirk worth knowing before you start labeling versions as prod and canary across a busy parameter. The newest documented capability touching Parameter Store sits outside the service itself: Amazon EC2 now surfaces the public SSM parameter tied to a public AMI in the image metadata.

AWS Secrets Manager

Secrets Manager stores, retrieves and rotates secrets. Rotation can run on demand or on a schedule, and AWS says it works for AWS and third-party secrets without redeploying or disrupting active applications. Pricing follows a simple model: $0.40 per secret per month, calculated hourly for secrets stored for part of a month, plus $0.05 per 10,000 API calls. Creating a new secret version during rotation carries no charge. For teams comparing AWS’s offering to other vaults, the breakdown of HashiCorp Vault, AWS Secrets Manager and Doppler goes deeper on the non-AWS options.

The service has been shipping steadily. On October 12, managed external secrets expanded to Databricks and Twilio. On October 14, AWS Transfer Family gained the ability to store SFTP server host keys in Secrets Manager. We cover each launch in the examples section below.

AWS AppConfig

AppConfig is the odd one out. It does not store secrets, and it is not a general parameter store. It delivers application configuration and feature flags to running software, so a flag can flip without a code change. AWS’s current documentation still calls it AWS AppConfig, under Systems Manager. In 2026 AWS added experimentation tooling on top of feature flags, and AWS guidance describes running production experiments with it.

Specs Table: Parameter Store vs Secrets Manager vs AppConfig

The table below puts the documented differences side by side. Where a cell says “see quotas,” AWS publishes the figure on a separate quotas page that we did not verify against a second source, so we left it out rather than guess.

Attribute	Parameter Store Standard	Parameter Store Advanced	Secrets Manager	AppConfig
Primary job	Small config values	Larger config, more parameters	Secrets with lifecycle management	Runtime config and feature flags
Product family	Systems Manager	Systems Manager	Standalone service	Systems Manager
Max value size	4 KB	8 KB	See quotas	See quotas
Items per Region per account	10,000	100,000	See quotas	See quotas
Storage price	No additional charge	$0.05 per parameter per month	$0.40 per secret per month	Usage-based
API price	Free at standard throughput	$0.05 per 10,000 interactions	$0.05 per 10,000 calls	Per request and per configuration received
Higher throughput option	$0.05 per 10,000 interactions	$0.05 per 10,000 interactions	Not a separate mode	Not applicable
Built-in secret rotation	No comparable feature	No comparable feature	Yes, on demand or on schedule	No
Managed third-party rotation	No	No	Yes, no custom Lambda needed for listed vendors	No
Version history	100 most recent versions	100 most recent versions	New version per rotation, no charge to create it	Not covered in our sources
Encrypted values	SecureString	SecureString	Encrypted, customer-managed KMS keys recommended	Not designed for secrets
Change notification	Parameter policies	Parameter policies	EventBridge notifications after value changes	Not covered in our sources
Typical consumer	Services reading settings	Large multi-team fleets	Apps and pipelines needing credentials	Apps needing live flag changes
Latest notable change	EC2 public AMI parameter	Same	Databricks and Twilio rotation, October 12, 2026	Experimentation tooling

Two rows deserve emphasis. First, the API price row shows that advanced parameters and Secrets Manager charge the same rate per 10,000 calls, so the gap between them is entirely the per-item fee. Second, the rotation rows are the only place where Parameter Store has no answer. Everything else, from encryption to IAM control, exists in both services in some form.

AWS Parameter Store Pricing vs Secrets Manager Pricing

AWS refreshed its Systems Manager and Secrets Manager pricing pages in October 2026, and both still list the same headline numbers. The table below pulls the rates into one place.

Cost item	Parameter Store Standard	Parameter Store Advanced	Secrets Manager
Monthly storage per item	$0	$0.05	$0.40
Proration	Not needed	Hourly if stored under a month	Hourly, about $0.00056 per secret per hour (rounded)
Annual storage per item	$0	Not listed	$4.80
API cost per 10,000 calls	$0 (standard throughput)	$0.05	$0.05
API cost per 10,000 with higher throughput	$0.05	$0.05	Not applicable
Cost to create a rotated version	Not applicable	Not applicable	$0
Console recommendations feature	Not applicable	Not applicable	No extra charge in supported commercial Regions
EventBridge change notifications	Not applicable	Not applicable	No additional feature charge

The hourly rate comes straight from AWS’s own worked example, which divides $0.40 by 30 days and 24 hours to get roughly $0.00056 per secret per hour. That matters for short-lived secrets, such as per-job credentials created and destroyed within the hour. AWS’s example of 5 million secrets stored for one hour plus 10 million API calls works out to about $2,800 for storage at the rounded hourly rate and $50 for the calls. You would not choose Secrets Manager for millions of ephemeral secrets without checking that math twice.

AppConfig bills differently. According to AWS’s pricing page as refreshed in October 2026, configuration requests cost $0.0000002 per request, each configuration received costs $0.0008, and experimentation costs $0.90 per experiment-run hour. These figures are single-source in our research, so treat them as indicative and confirm them on the live page for your Region. Experiment billing starts when a run begins and stops when it ends. AWS says defining experiments and treatments is free, and that downstream services such as CloudWatch Logs, Data Firehose, S3 and Athena bill separately at their normal rates.

If your search extends past AWS, the comparison of HashiCorp Vault, AWS Secrets Manager and Azure Key Vault shows how these per-secret fees stack up against the other major clouds and a self-hosted vault.

Cost Benchmarks From Three AWS Sources

Latency and throughput numbers for these services are scattered across community posts, and none we could verify were reproducible, so this section benchmarks what we can: dollars. The inputs come from three AWS-published sets of numbers. These are the Systems Manager pricing page, the Secrets Manager pricing page, and the worked examples on that Secrets Manager page, which include a 1,500-secret organization and a 10,000-secret organization. The totals below are our own arithmetic on those published rates.

Scenario (monthly)	Standard, standard throughput	Standard, higher throughput	Advanced	Secrets Manager
100 items, 1M API calls	$0	$5.00	$10.00	$45.00
1,000 items, 10M API calls	$0	$50.00	$100.00	Not listed
1,500 items, 900,000 API calls (AWS example)	$0	$4.50	Not listed	$604.50
10,000 items, 12M API calls (AWS example)	$0	$60.00	Not listed	$4,060.00

Read the table from the bottom. At 10,000 items, Secrets Manager costs far more each month than the advanced tier, and the gap is pure per-item fee: $0.40 per secret per month against $0.05 per advanced parameter per month, because the API charge of $0.05 per 10,000 calls is the same in both columns. Against the free standard tier, the whole bill is the difference.

At the small end, the picture flips from “expensive” to “irrelevant.” A hundred secrets cost $40 a month to store. For most production teams, one avoided credential leak or one skipped rotation project covers that bill for years. The right takeaway is not that Secrets Manager is overpriced. It is that you should not park thousands of non-secret settings in a service that charges per item.

Two caveats keep the table honest. The standard-tier cap is 10,000 parameters, so the 10,000-item row sits exactly at the ceiling. And real accounts mix types, so a more accurate model splits your inventory: secrets in Secrets Manager, everything else in Parameter Store. A fleet with 300 true secrets and the rest plain settings would pay 300 times $0.40, or $120, for the secrets and nothing for the settings at standard throughput.

Limits That Decide the Choice

Value size and item count

Parameter Store’s documentation, updated October 21, 2026, sets standard values at 4 KB and advanced values at 8 KB. That is plenty for connection strings, JSON toggles and short tokens. It is not enough for a certificate chain bundle or a large JSON policy document. If your payload is bigger than 8 KB, Parameter Store is out, and you should check the Secrets Manager and AppConfig quotas pages for your document size before committing.

Item counts matter at platform scale. The standard tier supports 10,000 parameters per Region per account, and the advanced tier supports 100,000. A company that uses one account per team per environment rarely hits either number. A company that stores one parameter per customer, per feature, per Region in a shared account can hit the standard cap faster than expected. Switching a parameter from Standard to Advanced is the usual fix, and the cost is $0.05 per parameter per month.

Version history and labels

Parameter Store retains the 100 most recently created versions of each parameter. When a new version arrives, the oldest unlabeled version drops off. A labeled version blocks that cleanup, and creation can fail if the oldest version is labeled and the history is full. Teams that use labels to mark release channels should move labels forward as part of their deploy scripts, or they will eventually meet the error in the middle of a release.

Secrets Manager handles history differently. Each rotation creates a new secret version, and AWS does not charge for creating it. That removes any penalty for rotating often, which is the behavior you want from a secrets service.

Throughput and API behavior

Parameter Store distinguishes standard throughput from higher throughput. Standard parameters at standard throughput have no additional API charge. Turning on higher throughput costs $0.05 per 10,000 interactions for both tiers. If you run thousands of containers that each read dozens of parameters at boot, you will meet throttling before you meet a bill, and the higher-throughput switch is the lever AWS gives you. Cache values in the process and refresh them on a timer. A single cold-start storm that reads every parameter once is cheap. A loop that reads the same parameter on every request is not.

Rotation, Encryption and Security Controls

Rotation is the feature that separates Secrets Manager from Parameter Store, and the gap widened this year. Secrets Manager can rotate on demand or on a schedule. For a growing list of third-party systems, it now does so as a managed external secret, with no custom Lambda function to write and patch. The vendors AWS names include BigID, Cisco Security Platform, Confluent Cloud, Datadog, GitLab, Jenkins, MongoDB Atlas, Netskope, Paddle, Salesforce, Snowflake and SonarQube. On October 12, 2026, AWS added Databricks personal access tokens and service principal OAuth client secrets, plus Twilio API keys and Auth Tokens, according to the week 42 cloud update from Toc Consulting.

Parameter Store has no built-in rotation workflow comparable to this. You can store a SecureString there, and you can script your own rotation with a scheduled job, but you own the logic, the failure handling and the audit trail. For a handful of low-risk tokens that is fine. For a database password shared by thirty services, it is the kind of project that gets postponed until after an incident.

Encryption and key choices

Both services can encrypt sensitive values. According to AWS, the Secrets Manager console now surfaces recommendations that nudge you toward customer-managed KMS keys and toward configuring rotation on secrets that lack it. AWS positions those as security posture improvements, available at no additional charge. An AWS Builder Center post from October 17, 2026, titled Day 19: AWS KMS and Secrets Manager, Protecting Data and Secrets, is a useful primer if your team is new to the pairing.

Access control and the leak path

Rotation limits the damage of a leak, but it does not prevent one. Most real incidents start with a token committed to a repository or pasted into a chat. The Discord exposure that prompted the guide on securing Discord bot tokens is a reminder of how far a single stolen credential can travel. Scope IAM policies to the exact secret or parameter path, avoid wildcard reads, and turn on rotation so a leaked value expires on its own. A DEV Community write-up from October 21, 2026 on Secrets Manager rotation, IAM scoping and production gotchas walks through those pitfalls in practice.

One more control: Secrets Manager can emit EventBridge notifications after a secret value changes. AWS lists Lambda, SNS, SQS and Step Functions as targets, which lets a service refresh a cached credential the moment a rotation completes. Parameter Store offers expiration notifications through parameter policies, but nothing equivalent to a change-triggered refresh pipeline.

Where AppConfig Fits Beside Parameter Store

Teams often start with Parameter Store for feature flags because it is free and already there. That works until you need a gradual rollout, a validator that rejects bad values before they reach production, or a quick rollback when a flag change misbehaves. AppConfig exists for those cases. It supports changing runtime behavior through feature flags and dynamic configuration without redeploying code.

AWS published guidance for running AppConfig feature flags in container environments, using a sidecar agent next to ECS and EKS workloads. In AWS’s example, the agent polls for updates at a configurable interval with a default of 45 seconds, so a flag change reaches pods within that window rather than on the next release. That default is single-source in our research, so treat it as an example value.

The experimentation layer is the newer part. AWS says its experimentation tools support A/B tests and multivariate experiments, with billing per experiment-run hour. The meter starts when a run begins and stops when someone ends it. The practical rule: if a value changes in response to a business decision, a rollout plan or an experiment, put it in AppConfig. If it changes only when an engineer edits infrastructure code, Parameter Store is simpler and cheaper.

Do not store secrets in AppConfig. It is built for configuration delivery, and it lacks the rotation, versioned secret lifecycle and audit focus that Secrets Manager provides. A typical clean design uses all three: AppConfig for flags, Parameter Store for static settings, and Secrets Manager for credentials.

Real-World Examples From 2026 AWS Launches and Pricing Samples

These eight examples come from AWS’s own worked pricing samples and from launches in the past four months. Each shows a different reason to choose one service over another.

1. A 1,500-secret enterprise. AWS’s third pricing example describes an organization with a monthly AWS spend above $40,000 that stores 1,500 secrets and makes 900,000 API calls a month (1,500 secrets times 20 calls a day times 30 days). Secrets Manager costs $604.50 a month for that workload. Putting the same inventory in the advanced tier would cost $79.50. The gap is worth a conversation, and the conversation should sort the 1,500 items into “must rotate” and “just settings.”

2. A 10,000-secret enterprise. The fourth AWS example covers an organization spending above $250,000 a month on AWS, with 10,000 secrets and 12 million API calls (10,000 secrets times 40 calls a day times 30 days). Secrets Manager comes to $4,060 a month there. At that scale, the per-item fee is a line item that finance will ask about, and a tiered inventory is the clean answer.

3. A small three-tier app. AWS’s first sample prices 15 secrets: SSH keys for a load balancer, web servers and app servers, plus five database credentials. At $0.40 each, storage is $6.00 a month before API calls. For a team this size, nobody should spend an afternoon optimizing, and the rotation capability alone justifies the fee.

4. Third-party tokens for data pipelines. On October 12, 2026, managed rotation arrived for Databricks tokens and Twilio keys. A data engineering team that used to hand-rotate a Databricks personal access token every quarter can now configure rotation in the console or API. Messaging teams get the same for Twilio API keys and Auth Tokens. AWS says no customer-maintained rotation Lambda is needed for these integrations.

5. CI/CD credentials. According to AWS announcements, managed rotation has arrived for Jenkins API tokens and SonarQube tokens, followed by Cisco Security Platform API keys and Netskope API tokens. Build systems hold some of the most powerful long-lived credentials in a company, which makes them natural candidates for a rotating secret rather than a static parameter.

6. SFTP server host keys. On October 14, 2026, AWS Transfer Family gained support for keeping SFTP server host keys in Secrets Manager, with IAM-controlled access, reuse across servers and Regions, and migration of existing keys. AWS states the feature carries no additional charge beyond normal Secrets Manager pricing, as tracked on the 365Fanatic cloud roadmap. For a file-exchange business, that moves a sensitive private key out of a server’s disk and into a managed store.

7. Cache refresh after rotation. According to AWS, EventBridge notifications can trigger Lambda, SNS, SQS or Step Functions workflows after a secret value changes. Wire it through Amazon EventBridge and a service can drop its cached credential and reload the moment a secret changes, instead of waiting for a timer or a failed login to tell it.

8. AMI discovery through Parameter Store. EC2’s DescribeImages call now returns the public SSM parameter name for public AMIs that have one. A launch template can reference that parameter as an alias for the latest image, so patched AMIs roll out without editing IDs. This is a classic Parameter Store job: public, small, free and read-only.

Use-Case Recommendations: Which Service for Which Job

The list below turns the data into direct picks. Each recommendation names the service and the reason in one line.

1. Database credentials: Secrets Manager. Rotation is the whole point, and a shared database password is the highest-value target in most stacks. If you run managed databases, the Amazon RDS setup guide shows where credentials enter the picture.
2. Third-party API keys (Twilio, Datadog, Snowflake, MongoDB Atlas): Secrets Manager. Managed rotation is available for many of them, and each one removes a custom Lambda from your backlog.
3. Service endpoints, table names, queue URLs: Parameter Store Standard. Free, small, versioned and easy to scope by path.
4. Latest AMI aliases: Parameter Store. The public SSM parameter pattern exists for this exact purpose.
5. Feature flags with gradual rollout: AppConfig. Controlled deployment and rollback beat editing a parameter by hand.
6. A/B tests and experiments: AppConfig. The experimentation tools bill by experiment-run hour and keep test logic out of application code.
7. Very large parameter fleets above 10,000 items: Parameter Store Advanced. The 100,000-parameter quota and 8 KB values give room to grow at $0.05 per parameter.
8. Short-lived per-job credentials in huge volumes: neither, at first glance. Run the hourly math (about $0.00056 per secret per hour) or use short-lived tokens issued by an identity service instead of stored secrets.

Pros and Cons of Each Service

Parameter Store

• Pro: Standard parameters carry no storage charge, and standard throughput carries no API charge.
• Pro: The advanced tier is 8 times cheaper than Secrets Manager per item.
• Pro: Holds up to 100,000 advanced parameters per Region per account.
• Pro: Native fit for AMI aliases and infrastructure settings.
• Con: No built-in rotation comparable to Secrets Manager.
• Con: Small value limits of 4 KB and 8 KB.
• Con: Labeled versions can block writes once history reaches 100 versions.

Secrets Manager

• Pro: Rotation on demand or on schedule, with managed rotation for named third-party vendors.
• Pro: No charge to create a rotated version.
• Pro: Console recommendations (October 2026) and EventBridge change notifications.
• Pro: AWS recommends it for database credentials, API keys and tokens.
• Con: $0.40 per secret per month adds up at thousands of items.
• Con: Costly for huge numbers of ephemeral secrets.
• Con: Overkill for plain settings that nobody needs to hide.

AppConfig

• Pro: Feature flags and dynamic configuration without code redeploys.
• Pro: Experimentation tools for A/B and multivariate tests.
• Pro: Container guidance for ECS and EKS sidecar delivery.
• Con: Usage-based billing is harder to forecast than a flat per-item fee.
• Con: Not a place for secrets.
• Con: Adds deployment concepts that small teams may not need.

Migration Guide: Moving Between Parameter Store and Secrets Manager

Most migrations go one direction: SecureString parameters that were never meant to hold credentials long term move into Secrets Manager so they can rotate. Occasionally teams go the other way, moving thousands of non-secret items out of Secrets Manager to cut the per-item fee. The steps below cover both directions. Plan on an afternoon for a small inventory and a sprint for a large one.

Step 1: Inventory and classify

List everything you store and tag each item as “secret,” “setting” or “flag.” A secret is any value that grants access if it leaks. A setting is everything else. A flag is a value that product or operations staff want to change without a deploy. Counting the secret group tells you the Secrets Manager bill in advance: multiply by $0.40 and add API calls.

aws ssm get-parameters-by-path \
  --path /myapp/prod/ --recursive \
  --query 'Parameters[].[Name,Type]' --output text

Step 2: Copy secrets into Secrets Manager

Write each secret through a temporary file with tight permissions, so the value never appears in your shell history or process list. Create the secret first, then switch the application, then retire the old parameter.

umask 077
for name in $(aws ssm get-parameters-by-path --path /myapp/prod/ --recursive \
  --query 'Parameters[?Type==`SecureString`].Name' --output text)
do
  tmp=$(mktemp)
  aws ssm get-parameter --name "$name" --with-decryption \
    --query Parameter.Value --output text > "$tmp"
  aws secretsmanager create-secret --name "${name#/}" \
    --secret-string "file://$tmp"
  rm -f "$tmp"
done

Step 3: Switch the application reads

Change your code or deployment template to read from Secrets Manager instead of Parameter Store. If you manage infrastructure as code, update the references in the same change, and the Terraform guide to deploying AWS infrastructure shows how to keep that change reviewable. Add a short in-process cache so you do not pay $0.05 per 10,000 calls for reads you could serve from memory.

Step 4: Turn on rotation

For vendors on the managed list, enable rotation in the console or API without writing a function. For anything else, you supply a rotation Lambda. Start with a 30-day schedule and shorten it once you trust the process.

aws secretsmanager rotate-secret \
  --secret-id myapp/prod/db \
  --rotation-lambda-arn arn:aws:lambda:REGION:ACCOUNT:function:ROTATOR \
  --rotation-rules AutomaticallyAfterDays=30

Step 5: Retire the old parameters

Keep the old SecureString for one release cycle, confirm no consumer still reads it using CloudTrail, then delete it. Remember that the old values were live credentials, so rotate them once after the cutover to make sure any copy left behind is dead.

Going the other way: Secrets Manager to Parameter Store

If an audit shows thousands of secrets that are really settings, reverse the flow. Create a Standard parameter for each, switch the readers, and delete the secrets. Deleted secrets stop accruing the $0.40 monthly fee, and a 1,500-item cleanup saves up to $600 a month. If any item exceeds 4 KB, use the Advanced tier at $0.05 per parameter, or keep it in Secrets Manager.

Mistakes That Inflate Bills or Leak Secrets

Using Secrets Manager for everything. It feels safest, and it is the quickest way to turn 10,000 settings into a $4,000 monthly line. Reserve it for values that need rotation or secret-grade handling.

Using Parameter Store for everything. The free tier invites storing database passwords as SecureString and never touching them again. AWS’s own advice is to move credentials, API keys and tokens to Secrets Manager. Static passwords age badly.

Reading on every request. Both services bill API calls beyond the free standard throughput, and Parameter Store can throttle busy fleets. Cache values and refresh on a timer or on a change notification.

Labeling every version. Because labeled versions block cleanup at the 100-version limit, a deploy script that labels each release can eventually stall. Move labels forward or remove them when a release retires.

Putting secrets in AppConfig. It delivers configuration well. It is not a secrets store, so keep credentials out of flag payloads.

Ignoring the console recommendations. The October 2026 Secrets Manager recommendations point at secrets with no rotation configured and at secrets that could use customer-managed keys. They cost nothing in supported commercial Regions, so read them.

Final Verdict: Parameter Store for Settings, Secrets Manager for Secrets

The data points to a split design rather than a single winner. Parameter Store wins on cost: $0 for standard parameters, $0.05 for advanced ones, against $0.40 for each secret. Secrets Manager wins on risk: scheduled rotation, managed rotation for vendors from Databricks to Twilio, a new version at no charge each time, and EventBridge notifications when values change. AppConfig wins on delivery: flags and experiments that change production behavior without a redeploy.

For a fleet of 10,000 items, the split design saves real money. Keeping only the 300 true secrets in Secrets Manager means paying $0.40 per secret per month for storage. Putting all 10,000 there would mean paying that rate on every single item. The remaining settings sit free in the standard tier, and a handful of flags run through AppConfig. Our recommendation: default to Parameter Store, promote any credential to Secrets Manager the day it needs rotation, and add AppConfig the first time someone asks to change a value without shipping code. For related pricing and platform changes, the cloud computing coverage tracks the market as it moves.

One last point on timing. AWS’s October 2026 pricing pages show the headline rates used throughout this article, and we found no confirmed price change in the final week before publication. Check the live pricing page for your Region before you commit a budget, since AWS can update figures at any time.

Frequently Asked Questions

Is AWS Parameter Store free?

Standard parameters carry no additional storage charge, and standard throughput carries no API charge. Advanced parameters cost $0.05 per parameter per month, prorated hourly, plus $0.05 per 10,000 API interactions. Higher throughput costs $0.05 per 10,000 interactions for both tiers. The claim that every Parameter Store parameter is free is outdated.

Is Secrets Manager worth $0.40 per secret?

For credentials that must rotate, yes. A secret costs $4.80 a year, which is small next to the effort of writing and maintaining your own rotation job. For plain settings, no. Those belong in Parameter Store, where the standard tier is free.

Can Parameter Store rotate secrets automatically?

AWS’s documentation does not describe a built-in rotation workflow for Parameter Store comparable to Secrets Manager. You can store a SecureString and write your own rotation job, but AWS recommends Secrets Manager for database credentials, API keys and tokens.

What are the size limits for Parameter Store values?

Standard parameter values are limited to 4 KB and advanced values to 8 KB, according to documentation updated October 21, 2026. The account quota is 10,000 standard parameters or 100,000 advanced parameters per Region.

When should I use AppConfig instead of Parameter Store?

Use AppConfig when a value must change in production on a controlled schedule, such as feature flags, gradual rollouts or experiments, without redeploying code. Use Parameter Store for static settings that change only through infrastructure updates.

Can I use all three services together?

Yes, and many teams do. AppConfig carries flags, Parameter Store holds static settings and AMI aliases, and Secrets Manager holds credentials that rotate. Keep each type of value in the service built for it.

How many versions does Parameter Store keep?

It retains the 100 most recently created versions of a parameter. The oldest version is removed when a new one is created unless it carries a label, in which case creation can fail until you remove the label.

Did AWS change these prices recently?

AWS refreshed the Systems Manager and Secrets Manager pricing pages in October 2026, and the rates quoted here match those pages. We did not find a confirmed price change in the week before publication. Verify the live pricing page for your Region before budgeting.