Secrets Manager secret was accessed in the last 90 days

​

What this check verifies

AWS Secrets Manager secrets with no retrieval activity beyond a configured window (default 90 days) are identified as unused based on their most recent access timestamp

​

Risk

Unused yet valid secrets jeopardize confidentiality and integrity:

• Reuse by ex-users or leaked code enables unauthorized access
• Limited rotation/revocation increases stealth persistence and data exfiltration
• Secret sprawl adds operational risk and extra cost

​

Recommendation

Apply a lifecycle policy for secrets:

• Require ownership tags and periodic reviews
• Rotate or disable, then retire secrets unused beyond policy
• Enforce least privilege and monitor retrievals with alerts
• Automate cleanup using recovery windows to prevent accidental loss

​

Remediation

​

References

• https://docs.aws.amazon.com/securityhub/latest/userguide/secretsmanager-controls.html#secretsmanager-3
• https://support.icompaas.com/support/solutions/articles/62000233606-ensure-secrets-manager-secrets-are-not-unused
• https://docs.aws.amazon.com/secretsmanager/latest/userguide/manage_delete-secret.html

​

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = secretsmanager_secret_unused. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to AWS checks