Description:
Secrets Manager is a service that allows you to store, manage, and rotate secrets. By default, Secrets Manager does not rotate keys. However, it is important to enable key rotation to help protect your secrets from unauthorized access.

Rationale:
If key rotation is not enabled, then the keys used to encrypt your secrets will never change. This means that if an attacker were to gain access to one of your secrets, they would be able to use the same key to access your secrets indefinitely.

Impact:
If key rotation is not enabled, and an attacker were to gain access to one of your secrets, they could use the same key to access your secrets indefinitely. This could lead to data breaches, financial losses, or even system downtime.

Default Value:
By default, Secrets Manager does not rotate keys.

Pre-requisites:

  • You must have an AWS account and be logged in to the AWS Management Console.
  • You must have the secrets manager Rotate Secret permission.


Remediation Steps:

  1. Sign in to the AWS Management Console.
  2. Go to the AWS Secrets Manager console.
  3. Select the secret that you want to rotate the key for.
  4. Click Rotate Secret.
  5. Follow the instructions in the wizard to rotate the key.


Test Plan:

  1. Verify that the key has been rotated by checking the Key Rotation Status.
  2. Try to access the secret using the old key.
  3. If you are unable to access the secret, then the key has been rotated correctly.

Implementation Plan:

  1. Create a policy that allows the Secrets Manager service to rotate keys.
  2. Implement the policy by attaching the policy to the Secrets Manager service.
  3. Monitor the status of the policy to ensure that keys are rotated on a regular basis.

AWS CLI Process:

  1. Run the following command to rotate the key for a secret:
aws secretsmanager rotate-secret --secret-id <secret-id>



Using AWS GUI:

  1. Go to the AWS Secrets Manager console.
  2. Select the secret that you want to rotate the key for.
  3. Click Rotate Secret.
  4. Follow the instructions in the wizard to rotate the key.


Backout Plan:

  1. If you accidentally delete the key, you can restore it by running the following command:
aws secretsmanager restore-secret --secret-id <secret-id> --secret-version <secret-version>
  1. You can also roll back the policy that allows the Secrets Manager service to rotate keys.


Note: