# Ensure Secret Manager Secret is Rotated Every 90 Days or Less

- Source: https://support.icompaas.com/support/solutions/articles/a_1788888308744126-ensure-secret-manager-secret-is-rotated-every-90-days-or-less
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that Secret Manager secrets have a rotation policy configured with a period of 90 days or less, so that a Pub/Sub notification is triggered on schedule to prompt (or automate) the creation of a new secret version, limiting how long any single secret value remains in active use.

**Rationale**

A secret value that is never rotated remains valid indefinitely, so if it is ever leaked, whether through logs, a compromised system, or an insider, it can be used by an attacker for as long as it remains unrotated. Configuring a rotation period of 90 days or less ensures secret values are refreshed on a predictable schedule, reducing the window of exposure for any single leaked credential and supporting compliance requirements that mandate periodic credential rotation.

**Impact**

-   Limits how long any single leaked secret value remains valid and useful to an attacker
    
-   Supports compliance requirements mandating periodic secret and credential rotation
    
-   Requires an automated rotation workflow (for example, via Cloud Functions triggered by the rotation Pub/Sub notification) to actually update the secret's value and downstream consumers without manual effort or service disruption
    

**Default Value**

By default, Secret Manager secrets have no rotation policy configured, and secret values are retained indefinitely until a new version is manually added.

**Pre-Requisites**

-   A Pub/Sub topic to receive rotation notifications
    
-   An automated rotation mechanism (such as a Cloud Function or Cloud Workflow) capable of generating a new secret value and adding it as a new version
    
-   IAM permissions to configure secret rotation settings (e.g., Secret Manager Admin)
    

**Test Plan**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to Security > Secret Manager and select the secret to review.
    
4.  Open the Rotation section of the secret's configuration.
    
5.  Verify that a rotation period is configured and that it is 90 days or less.
    
6.  Verify that a Pub/Sub topic is configured to receive the rotation notification, and that an automation exists to act on it.
    
7.  If no rotation policy exists, or the period exceeds 90 days, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Set up a Pub/Sub topic to receive rotation notifications, if one does not already exist.
    
3.  Implement and deploy an automated rotation handler (for example, a Cloud Function) subscribed to that topic, capable of generating a new secret value, adding it as a new secret version, and updating any dependent systems.
    
4.  Navigate to Security > Secret Manager and select the secret to update.
    
5.  Select Edit, then locate the Rotation section.
    
6.  Enable rotation, set the Rotation period to 90 days or less, and specify the Pub/Sub topic to notify.
    
7.  Save the configuration and confirm the next rotation time is displayed correctly.
    
8.  Test the rotation flow (for example, by triggering a manual rotation notification) to confirm the automation successfully creates a new secret version.
    

**Backout Plan**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to Security > Secret Manager and select the secret to update.
    
4.  Select Edit, then locate the Rotation section.
    
5.  Disable rotation or increase the rotation period beyond 90 days.
    
6.  Save the configuration.
    

**Reference**

-   [https://cloud.google.com/secret-manager/docs/secret-rotation](https://cloud.google.com/secret-manager/docs/secret-rotation)
    
-   [https://cloud.google.com/secret-manager/docs/rotation-recommendations](https://cloud.google.com/secret-manager/docs/rotation-recommendations)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.