# Ensure Secrets Manager secret has rotation enabled - Source: https://support.icompaas.com/support/solutions/articles/a_1793292247951150-ensure-secrets-manager-secret-has-rotation-enabled - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that every AWS Secrets Manager secret has automatic rotation enabled. With automatic rotation, Secrets Manager updates the secret value on a schedule, either through a rotation Lambda function or through managed rotation provided by the service that owns the secret. **Rationale** Secrets that are never rotated remain valid for a long time after they may have leaked through code, container images or logs. This widens the window for unauthorized access and lateral movement and makes incident response harder. Automatic rotation on a schedule that matches the sensitivity of the secret (for example, every 30 to 90 days) limits how long a leaked secret can be used. Applications should retrieve secrets at runtime instead of hardcoding them, so that they always use the current value. **Impact** - Limits how long a leaked or stolen secret remains usable - Applications that cache or hardcode the secret value may fail after rotation and must retrieve the secret from Secrets Manager instead - When rotation is enabled, Secrets Manager rotates the secret immediately by default, so the rotation function should be tested first **Default Value** Automatic rotation is not enabled for a new secret unless it is configured. Secrets created and managed by other AWS services may use managed rotation set up by that service. **Pre-Requisites** - IAM permissions: secretsmanager:ListSecrets, secretsmanager:DescribeSecret, secretsmanager:RotateSecret and secretsmanager:CancelRotateSecret - A rotation Lambda function for the secret type (Secrets Manager can create one for supported database secrets), with network access to the database and to Secrets Manager - Permission to create or use the rotation function: lambda:InvokeFunction, and lambda:CreateFunction and iam:CreateRole if the console creates a new function - Confirmation that the applications using the secret retrieve it from Secrets Manager at runtime **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Secrets Manager console and select a secret. 3. Open the **Rotation** tab. 4. Check that **Rotation status** is **Enabled**. 5. Repeat for each secret in each region in use. 6. If rotation is disabled for any secret, follow the implementation steps. **CLI:** List all secrets with their rotation status: aws secretsmanager list-secrets --region --query "SecretList\[\].\[Name,RotationEnabled,LastRotatedDate\]" --output table A secret fails if RotationEnabled is False or empty (None). **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Secrets Manager console and select the secret. 3. Open the **Rotation** tab and choose **Edit rotation**. 4. Turn on **Automatic rotation**. 5. Set the rotation schedule, for example every 30 days. 6. Select an existing rotation Lambda function, or create a new one for supported database secrets. 7. Choose **Save**. 8. Repeat for each affected secret in each region in use. **CLI:** Enable automatic rotation every 30 days with a rotation Lambda function (this also starts a rotation immediately): aws secretsmanager rotate-secret --region --secret-id --rotation-lambda-arn --rotation-rules AutomaticallyAfterDays=30 **Backout Plan** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Secrets Manager console and select the secret. 3. Open the **Rotation** tab and choose **Edit rotation**. 4. Turn off **Automatic rotation** and choose **Save**. **CLI:** aws secretsmanager cancel-rotate-secret --region --secret-id Note: turning off rotation does not restore the previous secret value. If an application fails after rotation, update it to retrieve the current value from Secrets Manager. Leaving rotation disabled keeps the secret valid indefinitely. **Reference** - [https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html) - [https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets\_strategies.html](https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets_strategies.html) - [https://docs.aws.amazon.com/cli/latest/reference/secretsmanager/rotate-secret.html](https://docs.aws.amazon.com/cli/latest/reference/secretsmanager/rotate-secret.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.