Secrets Manager secret is rotated within the max period

Check ID: secretsmanager_secret_rotated_periodically
Provider: AWS
Service: secretsmanager
Severity: MEDIUM
Categories: secrets
Resource type: AwsSecretsManagerSecret

What this check verifies

AWS Secrets Manager secrets are evaluated for periodic rotation within a configured window (default 90 days). Secrets with no recorded rotation, or with rotation older than the allowed window, are identified for review.

Risk

Long-lived or never-rotated secrets widen the attack window. Leaked or brute-forced credentials stay valid, enabling unauthorized access to databases and APIs, data exfiltration, and unauthorized changes-compromising confidentiality and integrity.

Recommendation

Enable automatic rotation for all secrets with intervals aligned to sensitivity (**90 days or more frequent). Ensure apps retrieve secrets at runtime. Apply least privilege to rotation roles and KMS keys, use separation of duties, and monitor rotation health with alerts. Avoid hard-coded credentials and retire unused secrets.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws secretsmanager rotate-secret —secret-id <secret-id>

# Enable rotation for the secret
resource "aws_secretsmanager_secret_rotation" "<example_resource_name>" {
  secret_id          = "<example_resource_id>"  # CRITICAL: target secret
  rotation_lambda_arn = "<example_resource_id>" # CRITICAL: Lambda ARN used to rotate

  rotation_rules {                          
    automatically_after_days = 30            # CRITICAL: rotate within allowed days
  }
}

# CloudFormation: enable rotation and rotate now
Resources:
  <example_resource_name>:
    Type: AWS::SecretsManager::RotationSchedule
    Properties:
      SecretId: <example_resource_id>  # CRITICAL: target secret to rotate
      RotationLambdaARN: <example_resource_id>  # CRITICAL: Lambda ARN used to perform rotation
      ScheduleExpression: rate(30 days)  # CRITICAL: ensures rotation occurs within max allowed days
      RotateImmediatelyOnUpdate: true  # CRITICAL: triggers an immediate rotation to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = secretsmanager_secret_rotated_periodically. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Secrets Manager secret resource policy blocks public access Secrets Manager secret was accessed in the last 90 days

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires