Latest / The Cloud Business Podcast with Fexingo: AWS, Azure, GCP, and Enterprise Infrastructure / Why Cloud Contracts Now Charge for Secret Rotation Frequency
Transcript
- Lucas: Luna, have you been tracking the new pricing line items in enterprise cloud contracts around secrets management? Luna: I've seen some chatter on Reddit, but nothing concrete. What are you seeing? Lucas: So AWS, Azure, and GCP are all starting to meter secret rotation events. It's not a flat monthly fee anymore—you get a baseline number of rotations included, and then they charge per rotation beyond that. Luna: Interesting. What's the baseline? Lucas: For AWS Secrets Manager, it's 50,000 rotations per month included in the standard $0.40 per secret per month fee. After that, it's $0.03 per 10,000 rotations. Azure Key Vault gives you 100,000 operations per vault per month for free, then $0.03 per 10,000. GCP Secret Manager offers 10,000 access operations per month free, then $0.03 per 1,000. Luna: So it's not huge per event, but if you're rotating frequently—like every hour for compliance—that adds up. Lucas: Exactly. Take a typical Kubernetes cluster with 200 secrets, rotated every week. That's 800 rotations per month per secret—160,000 total. On AWS, that's 110,000 billable rotations. At $0.03 per 10,000, that's thirty-three cents per secret per month. But if you rotate every hour for PCI compliance, you're looking at 144,000 rotations per month per secret. For 200 secrets, that's 28.8 million rotations. Billable portion: 28.75 million. That's $86.25 per month just in rotation fees—on top of the $80 in base secret fees. So $166 a month for secrets management. Luna: That's real money, especially for a mid-size organization with a few clusters. And it's not just Kubernetes secrets—what about service to service authentication, API keys, database credentials? Luna: Those all get swept into the same metering bucket. And the contract language is getting specific. I saw a clause in a recent AWS enterprise agreement that says, quote, 'Secret rotation events are measured per API call to RotateSecret, inclusive of automatic rotations triggered by the service.' Lucas: So even automated rotations from lifecycle policies count. That's a trap for teams that set and forget. Lucas: Correct. And now Azure and GCP are mirroring that language. The narrative from the providers is that secrets management is a security service with compute costs—each rotation requires cryptographic operations, audit logging, and replication across regions. But critics say it's just another way to monetize operational hygiene. Luna: I wonder if this is a reaction to the CISA guidelines from last year around secret rotation frequency. Lucas: I think it's exactly that. The guidance suggested rotating secrets every 30 days for most environments, and every 7 days for critical systems. Providers know that if customers follow that guidance, they'll generate more billable events. Luna: So what's the engineering response? Do you just move to HashiCorp Vault self-managed? Or use external secrets operators? Lucas: That's what a lot of teams are doing. The External Secrets Operator for Kubernetes pulls from Vault or cloud secret stores and caches them in-cluster, so you only call the API when the secret actually changes. But that introduces its own complexity—you need to manage Vault's high availability, replication, and backup. Luna: Right. And you still have to pay for the underlying compute and storage in Vault. Lucas: Exactly. So the cost trade-off isn't trivial. For a small team, the cloud-managed option might still be cheaper than running Vault across three availability zones with a sidecar per pod. Luna: What about using short-lived certificates instead of rotating secrets? Like SPIFFE or mTLS? Lucas: That's a growing pattern. If you use a service mesh like Istio or Linkerd, you get automatic certificate rotation without hitting a cloud secret store. But not every workload fits that model—legacy apps that need static database credentials still need a secret store. Lucas: And the providers are watching. I've seen contract language that charges for certificate issuance too—AWS Private CA charges per certificate per month, with a sliding scale based on volume. Luna: So it's not just secrets—it's any cryptographic material lifecycle that generates billable events. Lucas: Correct. And that's the broader trend: cloud contracts are moving from flat-rate services to usage-based metering on every operational action. It started with storage and compute, then API calls, now secrets. Next could be DNS query volume, which we covered a few episodes back. Luna: Yeah, and that one was surprising—charging per DNS query above a threshold. I think a lot of ops teams are going to get caught off guard by these line items. Lucas: That's why we keep drilling into these clauses. If these conversations are useful for what you're building or running, and you want to help us keep the show ad-free, listener support goes a long way. You can find us at buy me a coffee dot com slash fexingo. Luna: No pressure—just if it's helpful. We appreciate everyone who listens. Lucas: Alright, back to secrets. So one pattern I'm seeing is teams using a hybrid approach: cloud-managed secret store for the master secrets, then a local cache that rotates every hour without hitting the API. That cuts down billable rotations drastically. Luna: But doesn't that reintroduce the risk of stale secrets if the cache doesn't get updated? Lucas: It does. So you need a mechanism to invalidate the cache when a secret is revoked. That's where event-driven architectures come in—using cloud events to trigger cache eviction. Luna: So the providers are also charging for the event bus notifications, right? Lucas: Yes. AWS EventBridge charges per million events. So now you're paying for the rotation itself, plus the notification that tells you to rotate. It's death by a thousand cuts. Luna: So what's the best path forward for a team looking at a new cloud contract? Lucas: First, audit your current secret rotation patterns. How many secrets, how often, what triggers the rotation? Second, negotiate a flat-rate cap on secret operations in the contract. Some providers are willing to do that for committed spend. Luna: I've seen that too—especially with AWS Enterprise Discount Programs. You can get a fixed price for a certain number of secret operations per month. Lucas: Third, consider using a federated approach: one central vault that syncs to multiple clouds, so you only pay for the vault itself, not per-cloud rotation fees. Luna: But that adds latency and a single point of failure if the vault goes down. Lucas: Yeah, there's no free lunch. But the key takeaway is: don't ignore the secrets line item in your next contract renewal. It's small now, but it scales fast.