Secrets Manager secrets should be rotated within a specified number of days

How to fix it

• Can break clients: Saving with Rotate immediately when the secret is stored selected changes the password at once, and a client still holding the old one can then be refused.
• Affects another check: Turning rotation on brings the secret into SecretsManager.2, which fails it when a scheduled rotation is a day overdue.

In the console

Secrets Manager → Secrets → the secret → Rotation configuration → Edit rotation

Automatic rotation

On

Rotation schedule

Under 90 days, for example rate(30 days)

Rotation function

A Lambda function that can update the secret and the database or service it is for

Rotate immediately when the secret is stored

Selected, so an overdue secret rotates now rather than on its schedule

With the AWS CLI

aws secretsmanager rotate-secret --secret-id <secret-name> --rotation-lambda-arn <rotation-lambda-arn> --rotation-rules AutomaticallyAfterDays=30 --region <region>

With Terraform

resource "aws_secretsmanager_secret_rotation" "this" {
  secret_id           = var.secret_id
  rotation_lambda_arn = var.rotation_lambda_arn

  rotation_rules {
    automatically_after_days = 30
  }
}