Check provider logo

Secrets Manager secret has rotation enabled

secretsmanager_automatic_rotation_enabled

Severityhigh
Servicesecretsmanager
by Prowler
secrets

AWS Secrets Manager secrets are evaluated for automatic rotation; the check determines if a rotation schedule is enabled for each secret

Risk

Absent rotation, long-lived secrets widen the attack window:

  • Valid after leakage in code, images, or logs
  • Enable unauthorized access and lateral movement
  • Complicate incident response and recovery This impacts confidentiality and integrity, and can threaten availability if revocation lags.
Run this check with Prowler CLI

prowler aws --checks secretsmanager_automatic_rotation_enabled

Run in Prowler Cloud

Recommendation

Enable automatic rotation for secrets and set schedules based on sensitivity (e.g., 30-90 days). Enforce least privilege for accessing and rotating secrets and apply separation of duties. Monitor rotation health. Avoid hardcoded credentials; retrieve secrets at runtime and support versioned updates.

Remediation

CLI

aws secretsmanager rotate-secret --secret-id <example_resource_id> --rotation-lambda-arn <example_resource_id> --rotation-rules AutomaticallyAfterDays=30

Native IaC
Terraform
Other
  1. Open AWS Console > Secrets Manager
  2. Select the secret
  3. Click Rotation > Enable automatic rotation
  4. Choose the rotation Lambda function
  5. Set rotation interval to 30 days
  6. Save

Source Code

Resource Type

AwsSecretsManagerSecret

References