Description

Ensure that AWS Secrets Manager secrets are actively used, by verifying that each secret has been accessed (retrieved) within a defined period, such as the last 90 days, and that secrets which have not been accessed within that period are reviewed and either confirmed as still required, disabled, or deleted.

Rationale

A secret that has not been accessed in a long time may be an orphaned credential for a decommissioned application, an abandoned integration, or a forgotten test setup, and it represents unnecessary standing risk: if leaked, it could still grant access to whatever resource it was created for, even though no one is actively monitoring its use. Regularly reviewing secret access patterns and removing or rotating unused secrets reduces the number of forgotten, unmonitored credentials in the environment.

Impact

  • Reduces the number of orphaned or forgotten secrets representing unmonitored, standing risk

  • Encourages regular hygiene review of the organization's secrets inventory

  • Requires validation before deleting a flagged secret, to confirm it is not used by an infrequent but legitimate process

Default Value

Secrets Manager does not automatically flag or remove unused secrets; last-accessed information is available via the LastAccessedDate attribute and must be reviewed manually or via automation.

Pre-Requisites

  • IAM permissions to list secrets and view their last-accessed date (secretsmanager:ListSecrets, secretsmanager:DescribeSecret)

  • A documented maximum acceptable period of inactivity (for example, 90 days) approved by the organization

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS Secrets Manager > Secrets.

  3. For each secret, review the Last retrieved column (or use the CLI: aws secretsmanager describe-secret for the LastAccessedDate field).

  4. Identify any secret whose last-accessed date exceeds 90 days (or the organization's defined threshold).

  5. Cross-reference flagged secrets with application owners to confirm whether they are still required.

  6. If a secret exceeds the allowed inactivity period and is confirmed unnecessary, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS Secrets Manager > Secrets and select the flagged secret.

  3. As a precaution, do not immediately delete the secret; instead, consider disabling access via its resource policy or removing IAM permissions that reference it, and monitor for any failures from systems that may still depend on it.

  4. After a defined observation period with no issues reported, schedule the secret for deletion, which by default enforces a recovery window (typically 7 to 30 days) before permanent deletion.

  5. Document the secret name, justification, and disposition (disabled or deleted) for audit purposes.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS Secrets Manager > Secrets and, if the secret is still within its scheduled-deletion recovery window, select Cancel deletion to restore it.

  3. If the recovery window has passed, the secret must be recreated from a securely stored backup of its value, if available, or a new credential must be generated and distributed to dependent systems.

Reference