Description

Ensure that AWS Secrets Manager secrets, particularly those storing database credentials or other rotatable credentials, have automatic rotation enabled with an appropriate rotation Lambda function and schedule.

Rationale

A secret that is never rotated remains valid indefinitely, meaning that if it is ever leaked, whether through logs, a compromised system, or an insider, it can be used by an attacker for as long as it remains unrotated. Enabling automatic rotation ensures the underlying credential is periodically changed on a predictable schedule, limiting the window during which any single leaked credential remains valid and useful to an attacker.

Impact

  • Limits how long any single leaked secret value remains valid

  • Reduces reliance on manual, error-prone credential rotation processes

  • Requires a correctly configured rotation Lambda function and appropriate network/database connectivity for rotation to succeed without causing an application outage

Default Value

Automatic rotation is disabled by default for newly created Secrets Manager secrets.

Pre-Requisites

  • A rotation Lambda function appropriate to the secret type (AWS provides templates for common database engines)

  • Network connectivity (VPC configuration) allowing the rotation Lambda function to reach the target database or service

  • IAM permissions to configure secret rotation (secretsmanager:RotateSecret, secretsmanager:UpdateSecret)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS Secrets Manager > Secrets and select the secret to review.

  3. Open the Rotation configuration section.

  4. Verify that Automatic rotation shows as Enabled with an appropriate rotation schedule and a valid, functioning rotation Lambda function assigned.

  5. If rotation is disabled, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS Secrets Manager > Secrets and select the secret to update.

  3. Select Edit rotation.

  4. Enable Automatic rotation and select (or create) an appropriate rotation Lambda function, ensuring it has network access to the target resource.

  5. Define the rotation schedule (for example, every 30 or 90 days).

  6. Save the configuration and select Rotate secret immediately to test the rotation function end-to-end.

  7. Verify the application continues to authenticate successfully using the newly rotated credential.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS Secrets Manager > Secrets and select the affected secret.

  3. Select Edit rotation and disable Automatic rotation.

  4. Save the configuration.

Reference