Control: 1 Secrets Manager secrets should have automatic rotation enabled
Description
This control checks whether a secret stored in AWS Secrets Manager is configured with automatic rotation.
Secrets Manager helps you improve the security posture of your organization. Secrets include database credentials, passwords, and third-party API keys. You can use Secrets Manager to store secrets centrally, encrypt secrets automatically, control access to secrets, and rotate secrets safely and automatically.
Secrets Manager can rotate secrets. You can use rotation to replace long-term secrets with short-term ones. Rotating your secrets limits how long an unauthorized user can use a compromised secret. For this reason, you should rotate your secrets frequently. To learn more about rotation, see Rotating your AWS Secrets Manager secrets.
Remediation
To remediate this issue, you enable automatic rotation for your secrets.
To enable automatic rotation for secrets
- Open the Secrets Manager console.
- To find the secret that requires rotating, enter the secret name in the search field.
- Choose the secret you want to rotate, which displays the secrets details page.
- Under
Rotation configuration, choose Editrotation. - From
Edit rotation configuration, chooseEnable automatic rotation. - For
Select Rotation Interval, choose a rotation interval. - Choose a Lambda function for rotation. For information about customizing your Lambda rotation function, see Understanding and customizing your Lambda rotation function.
- To configure the secret for rotation, choose
Next.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_secretsmanager_1Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_secretsmanager_1 --shareSQL
This control uses a named query:
secretsmanager_secret_automatic_rotation_enabled