Secrets Manager secret has rotation enabled

Check ID: secretsmanager_automatic_rotation_enabled
Provider: AWS
Service: secretsmanager
Severity: HIGH
Categories: secrets
Resource type: AwsSecretsManagerSecret

What this check verifies

AWS Secrets Manager secrets are evaluated for automatic rotation; the check determines if a rotation schedule is enabled for each secret

Risk

Absent rotation, long-lived secrets widen the attack window:

Valid after leakage in code, images, or logs
Enable unauthorized access and lateral movement
Complicate incident response and recovery This impacts confidentiality and integrity, and can threaten availability if revocation lags.

Recommendation

Enable automatic rotation for secrets and set schedules based on sensitivity (e.g., 30-90 days). Enforce least privilege for accessing and rotating secrets and apply separation of duties. Monitor rotation health. Avoid hardcoded credentials; retrieve secrets at runtime and support versioned updates.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws secretsmanager rotate-secret --secret-id <example_resource_id> --rotation-lambda-arn <example_resource_id> --rotation-rules AutomaticallyAfterDays=30

resource "aws_secretsmanager_secret_rotation" "<example_resource_name>" {
  secret_id          = "<example_resource_id>"
  rotation_lambda_arn = "<example_resource_id>"
  rotation_rules {
    automatically_after_days = 30  # Critical: enables rotation schedule
  }
}

Resources:
  <example_resource_name>:
    Type: AWS::SecretsManager::RotationSchedule
    Properties:
      SecretId: <example_resource_id>
      RotationLambdaARN: <example_resource_id>
      RotationRules:
        AutomaticallyAfterDays: 30  # Critical: enables rotation on a 30-day schedule

References

https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets_strategies.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = secretsmanager_automatic_rotation_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Amazon SageMaker training job has VPC configuration enabled Secrets Manager secret has a restrictive resource policy

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires