# Ensure Secrets Manager secret has been accessed within the last 90 days - Source: https://support.icompaas.com/support/solutions/articles/a_1793292248914149-ensure-secrets-manager-secret-has-been-accessed-within-the-last-90-days - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that every AWS Secrets Manager secret has been retrieved within the last 90 days. Secrets Manager records the date a secret was last accessed, and secrets with no access in that period, or that have never been accessed, are considered unused and should be reviewed and deleted if no longer needed. **Rationale** Unused secrets often remain valid long after the application that needed them is gone. They can be reused by former users or through leaked code, and because they are not actively managed they are less likely to be rotated or revoked, allowing unnoticed persistence and data theft. A lifecycle process should assign an owner to each secret, review secrets periodically, and retire unused secrets using a recovery window to prevent accidental loss. **Impact** - Reduces the number of valid credentials that could be misused - Lowers Secrets Manager costs for secrets that are no longer needed - Any application or process that still relies on a deleted secret will fail; a secret scheduled for deletion can be restored only during its recovery window **Default Value** Secrets Manager does not delete unused secrets automatically. When a secret is deleted, it is kept for a recovery window of 30 days by default before being permanently removed. **Pre-Requisites** - IAM permissions: secretsmanager:ListSecrets, secretsmanager:DescribeSecret, secretsmanager:DeleteSecret, secretsmanager:RestoreSecret and secretsmanager:RemoveRegionsFromReplication - Confirmation from the secret owner that the secret is no longer needed. AWS CloudTrail GetSecretValue events can help identify any remaining users **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Secrets Manager console and select **Secrets**. 3. Select a secret and, on the **Overview** tab, check the **Last retrieved** date. 4. Repeat for each secret in each region in use. 5. If any secret has not been retrieved in the last 90 days, or has never been retrieved, follow the implementation steps. **CLI:** List all secrets with their last accessed date: aws secretsmanager list-secrets --region --query "SecretList\[\].\[Name,LastAccessedDate,CreatedDate\]" --output table A secret fails if LastAccessedDate is more than 90 days ago, or if it is empty (None), which means the secret has never been accessed. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Secrets Manager console and select the unused secret. 3. If the secret has replicas, in the **Replicate secret** section select each replica and choose **Actions**, then **Delete replica**. 4. Choose **Actions**, then **Delete secret**. 5. Keep the default waiting period or set one between 7 and 30 days, then choose **Schedule deletion**. 6. Repeat for each unused secret in each region in use. **CLI:** Remove a replica of the secret (only if it is replicated): aws secretsmanager remove-regions-from-replication --region --secret-id --remove-replica-regions Schedule the secret for deletion with a 30-day recovery window: aws secretsmanager delete-secret --region --secret-id --recovery-window-in-days 30 **Backout Plan** Before deleting, save the secret's details: aws secretsmanager describe-secret --region --secret-id > secret-details-backup.json To roll back within the recovery window: 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS Secrets Manager console and select **Secrets**. 3. In the secrets list preferences, turn on the option to show secrets scheduled for deletion. 4. Select the secret and choose **Cancel deletion**. 5. If replicas were removed, add them again with **Replicate secret**. **CLI:** aws secretsmanager restore-secret --region --secret-id Note: a secret cannot be restored after its recovery window ends. Restoring a secret keeps an unused credential valid. **Reference** - [https://docs.aws.amazon.com/secretsmanager/latest/userguide/manage\_delete-secret.html](https://docs.aws.amazon.com/secretsmanager/latest/userguide/manage_delete-secret.html) - [https://docs.aws.amazon.com/secretsmanager/latest/userguide/manage\_restore-secret.html](https://docs.aws.amazon.com/secretsmanager/latest/userguide/manage_restore-secret.html) - [https://docs.aws.amazon.com/securityhub/latest/userguide/secretsmanager-controls.html#secretsmanager-3](https://docs.aws.amazon.com/securityhub/latest/userguide/secretsmanager-controls.html#secretsmanager-3) - [https://docs.aws.amazon.com/cli/latest/reference/secretsmanager/delete-secret.html](https://docs.aws.amazon.com/cli/latest/reference/secretsmanager/delete-secret.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.