# Ensure Secrets Manager Unused Secrets Check

- Source: https://support.icompaas.com/support/solutions/articles/62000218455-ensure-secrets-manager-unused-secrets-check
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [Automation Policies](https://support.icompaas.com/support/solutions/folders/62000167189)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Description:**

AWS Secrets Manager helps you protect secrets needed to access your applications, services, and IT resources. Secrets Manager enables AWS to manage the secrets, it also makes it easy to follow the security best practices (such as encrypting secrets and rotating these regularly). Retrieving the secret from Secrets Manager ensures that developers and applications are using the latest version of your secrets.

### **Rationale:**

Amazon Secrets Manager helps you protect sensitive information needed to access your cloud applications, services and resources. Users and applications can use this service to retrieve secrets with a call to Secrets Manager API, enhancing access security by eliminating the need to hard code credentials in plain text.

### **Impact:**

AWS Secrets Manager helps you meet your security and compliance requirements by enabling you to rotate secrets safely without the need for code deployments. You can use AWS Secrets Manager to handle database credentials to meet security and compliance requirements in your organization. 

### **Default Value:**

Secrets Manager provides built-in integrations for MySQL, PostgreSQL and Aurora on Amazon Relational Database Service (RDS), and can rotate, manage and retrieve credentials for these database types natively. The Default value is 90 days. 

### **Pre-Requisite:**

1.AWS Secrets Manager service to create secrets that store

2.Manage Amazon RDS database access credentials.

### **Remediation:**

**Test Plan:**

Using AWS console 

1.  Login in to AWS Management Console.
    
2.  Open to AWS Secrets Manager dashboard at [https://console.aws.amazon.com/secretsmanager/](https://console.aws.amazon.com/secretsmanager/ "https://console.aws.amazon.com/secretsmanager/").
    
3.  Select **Secrets** which is In the left  navigation panel, 
    
4.  If you find the secret is not used from more than 90 days![](https://support.icompaas.com/assets/kb/cde7ce7da6ff58a3.png)
    
5.  Then follow the implementation steps to remove the secrets

  

**Using AWS CLI :** 

1.  ### By using this command you can see the list of Secrets
    
    aws secretsmanager list-secrets
    
      
    

### **Implementation Steps:**

1.  Sign in to AWS Management Console.
    
2.  Open to AWS Secrets Manager dashboard at [https://console.aws.amazon.com/secretsmanager/](https://console.aws.amazon.com/secretsmanager/ "https://console.aws.amazon.com/secretsmanager/").
    
3.  Select **Secrets** which is In the left  navigation panel![](https://support.icompaas.com/assets/kb/61c2809215104207.png)
    
4.  Select the secret you want to Delete![](https://support.icompaas.com/assets/kb/52111365dfd57654.png)
    
5.  Go to Actions tab and select Delete secret ![](https://support.icompaas.com/assets/kb/0087cc85a9a94820.png) 
    

**Using AWS CLI:**

1.  **By giving this command you can delete the secret but you will have a recovery option untill 7 days from deleting**
    
    aws secretsmanager delete-secret \\
        --secret-id MyTestSecret \\
        --recovery-window-in-days 7
    
      
    
2.  **By giving this command you will not have recovery option**
    
    aws secretsmanager delete-secret \\
        --secret-id MyTestSecret \\
        ----force-delete-without-recovery
    
      
    

### **Backout Plan:**

If you want to recover the secret the use the command interface to delete the secret. 

  

#### **Reference:**

-   [![](https://support.icompaas.com/assets/kb/c7c59338d38f9ce8.png)Security in AWS Secrets Manager - AWS Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/security.html) 
-   [![](https://support.icompaas.com/assets/kb/cb7edeab61dcbf73.png)secretsmanager — AWS CLI 1.22.73 Command Reference](https://docs.aws.amazon.com/cli/latest/reference/secretsmanager/index.html) 
-   [![](https://support.icompaas.com/assets/kb/592dddd9b54c14c4.png)list-secrets — AWS CLI 1.22.77 Command Reference](https://docs.aws.amazon.com/cli/latest/reference/secretsmanager/list-secrets.html) 
-   [![](https://support.icompaas.com/assets/kb/b68a7f954a18e717.png)What is AWS Secrets Manager? - AWS Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html?icmpid=docs_asm_console)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.