Hacker News new | ask | show | jobs
by sessy 2339 days ago
Comparable AWS Version: https://aws.amazon.com/secrets-manager/

Pricing: AWS: $0.40 per secret per month. GCP: $0.06 per active secret version per regional replica per month.

i don't understand the GCP pricing correctly. Can someone shine a light here ...
4 comments
davedx 2339 days ago
For AWS, as with many cloud offerings, read the pricing small print: AWS Secret Manager also charges per API request [1]. It isn't expensive, but you should keep it in mind when you architect your infrastructure. (We actually switched from fetching secrets at runtime to injecting them into containers are deploy time, and this was one reason).

https://aws.amazon.com/secrets-manager/pricing/

link
jaxr 2339 days ago
This bit us too. We use goodaddy's external secrets [1] to fetch secrets from AWS secrets manager and make them available to the cluster. It polls the secret every n seconds, but with many services consuming secrets, it can scale up pretty quickly and start to build up cost.

[1] https://github.com/godaddy/kubernetes-external-secrets

link
junar 2339 days ago
Yes, GCP also has a cost based on the number of API requests, according to this page:

https://cloud.google.com/secret-manager/pricing

link
sethvargo 2339 days ago
Sorry the pricing is unclear. In Secret Manager, secrets are versioned (a "secret" is a named collection of "secret versions"). We only charge for active secret versions (you can destroy secret versions, usually after a rotation operation).

The secret version contains that actual secret data (i.e. "ABCD1234"), and you can choose the regions in which you want that secret data replicated. Each region you choose is $0.06.

So if you had 1 secret with 12 versions stored in 2 regions, that would be 12 x 2 x $0.06/mo = $1.44. Hope that helps!

EDIT: replaced "*" with "x" in math because it was getting parsed as italics

link
vegardx 2339 days ago
Seems more comparable to parameter store, which comes in both a paid and "free" version. Secrets Manager does have some of the same capabilities, but it also extends it to things like short lived credentials.
link
merb 2339 days ago
you can store gcp secrets, in multiple regions, so you pay for every region 0.06 cent, i.e. if you only want one region you only pay 0.06 cent
link