More Info:

Ensure that the rotation interval for your AWS Secrets Manager secrets is configured to meet security and compliance requirements. Prior to running this rule by the Cloud Conformity engine, the rotation interval (in days) must be configured in the rule settings, on your Cloud Conformity account dashboard. Amazon Secrets Manager rotation feature represents the automatic process that periodically change your secrets information to make it more difficult for attackers to access the services and resources secured with these secrets.

Risk Level

Medium

Address

Security

Compliance Standards

HITRUST, AWSWAF, PCIDSS, ISO27001

Triage and Remediation

Remediation

To remediate the issue of Secrets Manager secrets not being rotated frequently in AWS using the AWS console, follow these steps:

  1. Open the AWS Secrets Manager console.
  2. Select the secret that needs to be rotated.
  3. Click on the “Rotation” tab.
  4. Click on the “Edit rotation” button.
  5. In the “Configure rotation” section, select the rotation frequency and the number of days to keep the previous version of the secret.
  6. Click on the “Enable rotation” checkbox.
  7. Choose the Lambda function or AWS Secrets Manager to rotate the secret.
  8. Click on the “Save changes” button.

By following these steps, the Secrets Manager secret will be automatically rotated according to the selected frequency, and the previous versions of the secret will be kept for the specified number of days.

Additional Reading: