Secrets Manager secrets should have automatic rotation enabled

How to fix it

• Can break clients: The first rotation starts on save unless Rotate immediately when the secret is stored is cleared, and a client still holding the old password can then be refused.
• Affects another check: Turning rotation on brings the secret into SecretsManager.2, which fails it when a scheduled rotation is a day overdue; a schedule under 90 days clears SecretsManager.4 once it rotates.

In the console

Secrets Manager → Secrets → the secret → Rotation configuration → Edit rotation

Automatic rotation

On

Rotation schedule

A schedule expression such as rate(30 days); under 90 days also keeps SecretsManager.4 passing

Rotation function

A Lambda function that can update the secret and the database or service it is for

With the AWS CLI

aws secretsmanager rotate-secret --secret-id <secret-name> --rotation-lambda-arn <rotation-lambda-arn> --rotation-rules AutomaticallyAfterDays=30 --region <region>

With Terraform

resource "aws_secretsmanager_secret_rotation" "this" {
  secret_id           = var.secret_id
  rotation_lambda_arn = var.rotation_lambda_arn

  rotation_rules {
    automatically_after_days = 30
  }
}