Back to Checks
aws

Secrets Manager secret has rotation enabled

secretsmanager_automatic_rotation_enabled
Service: secretsmanagerSeverity: high
OfficialBuilt-inVerified
Categories:secrets
Resource Type:AwsSecretsManagerSecret

AWS Secrets Manager secrets are evaluated for automatic rotation; the check determines if a rotation schedule is enabled for each secret

Prowler logoProwlerprowler-provider-aws

Risk

Absent rotation, long-lived secrets widen the attack window:

  • Valid after leakage in code, images, or logs
  • Enable unauthorized access and lateral movement
  • Complicate incident response and recovery This impacts confidentiality and integrity, and can threaten availability if revocation lags.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks secretsmanager_automatic_rotation_enabled

Recommendation

Enable automatic rotation for secrets and set schedules based on sensitivity (e.g., 30-90 days). Enforce least privilege for accessing and rotating secrets and apply separation of duties. Monitor rotation health. Avoid hardcoded credentials; retrieve secrets at runtime and support versioned updates.

Remediation

CLI

aws secretsmanager rotate-secret --secret-id <example_resource_id> --rotation-lambda-arn <example_resource_id> --rotation-rules AutomaticallyAfterDays=30

Terraform

resource "aws_secretsmanager_secret_rotation" "<example_resource_name>" {
  secret_id          = "<example_resource_id>"
  rotation_lambda_arn = "<example_resource_id>"
  rotation_rules {
    automatically_after_days = 30  # Critical: enables rotation schedule
  }
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::SecretsManager::RotationSchedule
    Properties:
      SecretId: <example_resource_id>
      RotationLambdaARN: <example_resource_id>
      RotationRules:
        AutomaticallyAfterDays: 30  # Critical: enables rotation on a 30-day schedule

Other

1Open AWS Console > Secrets Manager
2Select the secret
3Click Rotation > Enable automatic rotation
4Choose the rotation Lambda function
5Set rotation interval to 30 days
6Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.secretsmanager.secretsmanager_client import (
    secretsmanager_client,
)


class secretsmanager_automatic_rotation_enabled(Check):
    def execute(self):
        findings = []
        for secret in secretsmanager_client.secrets.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=secret)
            if secret.rotation_enabled:
                report.status = "PASS"
                report.status_extended = (
                    f"SecretsManager secret {secret.name} has rotation enabled."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"SecretsManager secret {secret.name} has rotation disabled."
                )

            findings.append(report)

        return findings

References