Secrets Manager secret must have rotation enabled

High AWS General aws-secretsmanager-secret-key-rotation

Applies to

AWS::SecretsManager::Secret

What CGPulse checks

A resource passes this rule when rotationEnabled must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable automatic rotation to reduce the risk of long-lived credential compromise. In AWS Console: Secrets Manager > select secret > Rotation > Enable. See: https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html

Terraform

resource "aws_secretsmanager_secret_rotation" "{name}" {
  secret_id           = aws_secretsmanager_secret.{name}.id
  rotation_lambda_arn = aws_lambda_function.rotation.arn
  rotation_rules {
    automatically_after_days = 90
  }
}

Compliance frameworks

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan