Description

Ensure that every AWS Secrets Manager secret has been retrieved within the last 90 days. Secrets Manager records the date a secret was last accessed, and secrets with no access in that period, or that have never been accessed, are considered unused and should be reviewed and deleted if no longer needed.

Rationale

Unused secrets often remain valid long after the application that needed them is gone. They can be reused by former users or through leaked code, and because they are not actively managed they are less likely to be rotated or revoked, allowing unnoticed persistence and data theft. A lifecycle process should assign an owner to each secret, review secrets periodically, and retire unused secrets using a recovery window to prevent accidental loss.

Impact

  • Reduces the number of valid credentials that could be misused

  • Lowers Secrets Manager costs for secrets that are no longer needed

  • Any application or process that still relies on a deleted secret will fail; a secret scheduled for deletion can be restored only during its recovery window

Default Value

Secrets Manager does not delete unused secrets automatically. When a secret is deleted, it is kept for a recovery window of 30 days by default before being permanently removed.

Pre-Requisites

  • IAM permissions: secretsmanager:ListSecrets, secretsmanager:DescribeSecret, secretsmanager:DeleteSecret, secretsmanager:RestoreSecret and secretsmanager:RemoveRegionsFromReplication

  • Confirmation from the secret owner that the secret is no longer needed. AWS CloudTrail GetSecretValue events can help identify any remaining users

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Secrets Manager console and select Secrets.

  3. Select a secret and, on the Overview tab, check the Last retrieved date.

  4. Repeat for each secret in each region in use.

  5. If any secret has not been retrieved in the last 90 days, or has never been retrieved, follow the implementation steps.

CLI:

List all secrets with their last accessed date:

aws secretsmanager list-secrets --region <REGION> --query "SecretList[].[Name,LastAccessedDate,CreatedDate]" --output table

A secret fails if LastAccessedDate is more than 90 days ago, or if it is empty (None), which means the secret has never been accessed.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Secrets Manager console and select the unused secret.

  3. If the secret has replicas, in the Replicate secret section select each replica and choose Actions, then Delete replica.

  4. Choose Actions, then Delete secret.

  5. Keep the default waiting period or set one between 7 and 30 days, then choose Schedule deletion.

  6. Repeat for each unused secret in each region in use.

CLI:

Remove a replica of the secret (only if it is replicated):

aws secretsmanager remove-regions-from-replication --region <REGION> --secret-id <SECRET_ID> --remove-replica-regions <REPLICA_REGION>

Schedule the secret for deletion with a 30-day recovery window:

aws secretsmanager delete-secret --region <REGION> --secret-id <SECRET_ID> --recovery-window-in-days 30

Backout Plan

Before deleting, save the secret's details:

aws secretsmanager describe-secret --region <REGION> --secret-id <SECRET_ID> > secret-details-backup.json

To roll back within the recovery window:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS Secrets Manager console and select Secrets.

  3. In the secrets list preferences, turn on the option to show secrets scheduled for deletion.

  4. Select the secret and choose Cancel deletion.

  5. If replicas were removed, add them again with Replicate secret.

CLI:

aws secretsmanager restore-secret --region <REGION> --secret-id <SECRET_ID>

Note: a secret cannot be restored after its recovery window ends. Restoring a secret keeps an unused credential valid.

Reference