Description

Ensure that every AWS Secrets Manager secret has automatic rotation enabled. With automatic rotation, Secrets Manager updates the secret value on a schedule, either through a rotation Lambda function or through managed rotation provided by the service that owns the secret.

Rationale

Secrets that are never rotated remain valid for a long time after they may have leaked through code, container images or logs. This widens the window for unauthorized access and lateral movement and makes incident response harder. Automatic rotation on a schedule that matches the sensitivity of the secret (for example, every 30 to 90 days) limits how long a leaked secret can be used. Applications should retrieve secrets at runtime instead of hardcoding them, so that they always use the current value.

Impact

  • Limits how long a leaked or stolen secret remains usable

  • Applications that cache or hardcode the secret value may fail after rotation and must retrieve the secret from Secrets Manager instead

  • When rotation is enabled, Secrets Manager rotates the secret immediately by default, so the rotation function should be tested first

Default Value

Automatic rotation is not enabled for a new secret unless it is configured. Secrets created and managed by other AWS services may use managed rotation set up by that service.

Pre-Requisites

  • IAM permissions: secretsmanager:ListSecrets, secretsmanager:DescribeSecret, secretsmanager:RotateSecret and secretsmanager:CancelRotateSecret

  • A rotation Lambda function for the secret type (Secrets Manager can create one for supported database secrets), with network access to the database and to Secrets Manager

  • Permission to create or use the rotation function: lambda:InvokeFunction, and lambda:CreateFunction and iam:CreateRole if the console creates a new function

  • Confirmation that the applications using the secret retrieve it from Secrets Manager at runtime

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Secrets Manager console and select a secret.

  3. Open the Rotation tab.

  4. Check that Rotation status is Enabled.

  5. Repeat for each secret in each region in use.

  6. If rotation is disabled for any secret, follow the implementation steps.

CLI:

List all secrets with their rotation status:

aws secretsmanager list-secrets --region <REGION> --query "SecretList[].[Name,RotationEnabled,LastRotatedDate]" --output table

A secret fails if RotationEnabled is False or empty (None).

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Secrets Manager console and select the secret.

  3. Open the Rotation tab and choose Edit rotation.

  4. Turn on Automatic rotation.

  5. Set the rotation schedule, for example every 30 days.

  6. Select an existing rotation Lambda function, or create a new one for supported database secrets.

  7. Choose Save.

  8. Repeat for each affected secret in each region in use.

CLI:

Enable automatic rotation every 30 days with a rotation Lambda function (this also starts a rotation immediately):

aws secretsmanager rotate-secret --region <REGION> --secret-id <SECRET_ID> --rotation-lambda-arn <ROTATION_LAMBDA_ARN> --rotation-rules AutomaticallyAfterDays=30

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Secrets Manager console and select the secret.

  3. Open the Rotation tab and choose Edit rotation.

  4. Turn off Automatic rotation and choose Save.

CLI:

aws secretsmanager cancel-rotate-secret --region <REGION> --secret-id <SECRET_ID>

Note: turning off rotation does not restore the previous secret value. If an application fails after rotation, update it to retrieve the current value from Secrets Manager. Leaving rotation disabled keeps the secret valid indefinitely.

Reference