All checks
Medium
Secrets Manager secrets configured with automatic rotation should rotate successfully
Checks that a Secrets Manager secret with automatic rotation turned on rotated as scheduled; it fails once a scheduled rotation is more than a day overdue. A secret whose rotation keeps failing keeps its old credentials however short its schedule.
- service
- SecretsManager
- severity
- Medium
- scope
- evaluated in every region
How to fix it
- Can break clients: A rotation that completes changes the password, so a client still holding the old one can be refused on its next connection.
In the console
Secrets Manager → Secrets → the secret → Rotation configuration
- Lambda rotation function
- Its CloudWatch logs show the failing step; it needs network access to the database and Secrets Manager
- Rotate secret immediately
- Once the cause is fixed; the finding clears when a rotation completes
With the AWS CLI
aws secretsmanager rotate-secret --secret-id <secret-name> --region <region>See which of your accounts this check is failing on.
Book a live scan